loading table of contents...

Headless Server Developer Manual / Version 2310

Table Of Contents

3.5.6 MediaType Content Negotiation

The MediaController is responsible for the delivery of binary contents like images and other content types. For security reasons, the Spring framework sets the HTTP Content-Disposition response header to the static value inline; filename=f.txt for potentially insecure content types, for example, PDF files, unless it was specifically set previously.

This behaviour may produce undesirable results when downloading files via the MediaController, as the filename is anonymous and the content type is forced to the suffix txt, no matter what the real content type might be.

It is however possible to configure Spring to suppress this default behaviour for specific content types, using CaasConfig.

 * Code example to suppress the default Content-Disposition header for
 * potentially insecure content types. Add to CaasConfig if necessary.
public void configureContentNegotiation(
  ContentNegotiationConfigurer configurer
) {
  configurer.mediaType("pdf", MediaType.APPLICATION_PDF);
  configurer.mediaType("eps", new MediaType("application", "postscript"));

Example 3.2. Configuring Content Type Resolution for PDF and EPS Files

Please see the original Spring Web MVC Documentation about Content Types for a more detailed insight about the security aspects and about so called reflected file download attacks (RFD).

Also refer to Chapter 12, Media Endpoint about how the MediaController sets the Content-Disposition response header.

Search Results

Table Of Contents

Your Internet Explorer is no longer supported.

Please use Mozilla Firefox, Google Chrome, or Microsoft Edge.