Why is there a 'Content-Disposition' header added to ajax responses? about gae-secure-scaffold-python

[pames]

It's a defense in depth feature. Some browsers / plugins will incorrectly interpret responses as HTML (a feature known as "content sniffing") regardless of other headers and their value, e.g. the Content-Type. This is particularly dangerous when certain characters which would otherwise be harmless in Javascript strings (e.g. "<") have meaning in HTML context.

It's not uncommon for input parameters to be reflected (e.g. picture a results object, { "searchTerm": "userInput", "results": [ ... ] } ) in responses. An attacker could craft a link like "https://example.com/ajaxSearch?term=$malicious_string" and if a user were to visit it, the script may execute (if content sniffed).

We try to guard against this in api_fixer.py by escaping '<' and so on as '\u003c', but this is another defense mechanism against that style of attack. By serving "content-disposition: attachment" the browser will prompt the user to save the file, rather than possibly execute malicious script in that web origin.

One compromise for local debugging (if you need to see these responses) might be to allow an option to disable this feature in the dev_appserver environment.