Does Content-Disposition have useful meaning?

[mikewest]

My understanding is that Content-Disposition will force a download for resources which are navigated to (either top-level or in frames), which might have some use? It doesn't seem to have effect on resources loaded as subresources in modern browsers... I see it all over Google, Facebook, Twitter, etc. endpoints (for example https://www.google.com/complete/search?q=public-webappsec), and it's not clear to me what it's meant to mitigate.

/cc @arturjanc who asked about this.

[shhnjk]

From what I know, Content-Disposition was used to tell browsers that the content is not for rendering. I think it was useful for telling browsers to not load plugin with that resource (or something similar, but I forgot :( ).

The second thing was RFD. To prevent RFD, you'd had to have Content-Disposition with filename specified so that it won't be downloaded as a different file type from trusted source.

But both of those things might be mitigated by default by some browsers today.

[mikewest]

But both of those things might be mitigated by default by some browsers today.

This is mostly what I'm interested in. I was hoping @arturjanc would have exciting details about attacks this mitigates in modern browsers, but he asked me about it, so. Idunno. :) Feels like something that might just be cargo-culted from the past.

[arturjanc]

I asked some folks about this and will report back if I learn anything useful. My guess is that one of the main reasons for this was to prevent attacks like Rosetta Flash because Adobe Flash was fixed to ignore SWFs with Content-Disposition: attachment.

[mikewest]

Based on that internal thread, I'm fairly convinced that Content-Disposition is useful in the presence of Flash, but its effect on navigation can be more clearly obtained via Content-Security-Policy: sandbox, which both prevents script execution and shifts the resource into an opaque origin. Given that Flash is no longer a boundary we need to be concerned with (as users who have intentionally installed a pre-killswitch version will remain vulnerable in perpetuity), I'll drop the recommendation from this doc and add a note about CSP as a belt-and-suspenders approach.