Firefox Ignores Content-Disposition-CodePudding

I'm trying to write MVC endpoint that will optionally set the content-disposition to inline or attachment in order to either display the file (a pdf) inside a new browser tab or else to download it. The UI allows the user to select how they'd like to open the file (not my design - can't change that aspect of it).

Note that this works in Chrome/Edge just as expected.

In Firefox, the application settings for PDF appear to trump the content-disposition. Is there a reliable way to get Firefox to respect the content-disposition? Preferably a way that will work w/ a vanilla installation of the browser such that end-users don't need to make any modifications on their end for it to work.

Here's the code I'm using to setup my response (class is derived from ApiController):

var response = Request.CreateResponse(System.Net.HttpStatusCode.OK);
response.Content = new PushStreamContent((stream, content, context) =>
{
    dispatcher.Dispatch(request, stream);
}, new MediaTypeHeaderValue(MediaTypeNames.Application.Pdf));


response.Content.Headers.ContentDisposition = new ContentDispositionHeaderValue(contentDisposition)
{
    FileName = $"{auto_generated_fileName}.pdf",
};

response.Headers.CacheControl = new CacheControlHeaderValue()
{
    NoCache = true,
    NoStore = true
};

return response;

CodePudding user response：

We have noticed this issue in our webapp as well. The webapp has a download button that lets the user download a PDF file. Firefox shows the PDF file in the current tab, which effectively kills the webapp.

After a bit of research, this appears to be an intentional feature, see the release notes for Firefox 98:

When you set an application to open files of a specific type in your Firefox preference settings, those files will open automatically, even files served by the website with "content-disposition: attachment". The same applies to PDF files that are set to open in Firefox by default. This is a fix to bug 453455.

Personally, while I can understand some users may want this for web pages that don't behave well, this is an issue for well-behaved web apps.

Setting the download attribute on the anchor does not appear to work either, Firefox still shows the file inline (tested with Firefox 99.0)

So as far as I am aware, you cannot force the browser to download the file if the browser does not allow it. Other web apps such as OwnCloud or Google Drive are having the same issue -- if you click right on a PDF file in Google Drive and then click on Dowload, Firefox still open the PDF file inline, whereas Chrome downloads it.

For now, it seems the best you can do is to open file in a new tab, to prevent the webapp or web page from being replaced by the downloaded file (which is also what Google Drive seems to be doing). You can open the download in a new tab or window e.g. via the target attribute on an <a> links or via the formtarget atttribute on a <button> element.