Downloading an svg file using the file browser fails

[ellisonbg]

To reproduce:

• Create an svg file.
• Right click on it in the file browser.
• Select "Download"

Browser gives a download error.

[jasongrout]

I just went to an svg in our source, right clicked, and downloaded, and it worked great. What was the error?

[echarles]

I have just build current master and tried to download a file (svg, ppt...) - I get error in the chrome (Failed - Forbidden) - Strangely, I don't see a request in devtools.

The server log shows:

[W 09:08:19.210 LabApp] Blocking request with no referer
[W 09:08:19.211 LabApp] 403 GET /files/amazon/AWS_Simple_Icons_ppt.pptx (::1): Blocking request from unknown origin
[W 09:08:19.212 LabApp] 403 GET /files/amazon/AWS_Simple_Icons_ppt.pptx (::1) 2.16ms referer=None

Strangely, the same actions in Firefox works well (no error, file is downloaded correctly)!!!

Chrome Incognito fails also.

[echarles]

This is prolly duplicate of #6609. I guess @jasongrout browser if FF while @saulshanabrook and @ellisonbg browser is Chrome.

[jasongrout]

I guess @jasongrout browser if FF

You're right that I am using FF. Sorry for not mentioning it earlier.

[jasongrout]

#6106 looks relevant

[jasongrout]

Looks like we should probably revert #6546, given the discussion on #6106 and #6546.

[jasongrout]

Or perhaps we can (shudder) do a browser test and only have the download attribute in firefox, but not in Chrome?

[athornton]

1.0.0a.10 still exhibits this behavior: in Chrome, I get a "Failed - Forbidden" when I try to download a file. (It appears that file type does not matter). I can download in Safari.

Most of my users use Chrome, and many of them like to download files.

As far as I can tell, no log of the event is being generated--I neither see an HTTP request on the Network tab of Developer Tools nor a log in the console.

[tslaton]

I'm working on this right now.

[tslaton]

Adding the xsrf token as @minrk suggested here: #6106 (comment) solves this issue. But I'm wary of the potential security implications of doing this. I don't have a good understanding of the xsrf token.

Is there a risk in exposing it in the href in this way @minrk?

[tslaton]

If PR #6686 looks secure, I recommend we go with it. I'm going to create another PR with an approach I know is safe in the meantime.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related discussion.