Filename on GitHub Releases not correctly set in Google Chrome

Google Chrome (75.0.3770.100) on Mac OS X ignores the content-disposition header filename for release downloads. You can reproduce by downloading e.g. https://github.com/java-decompiler/jd-gui/releases/tag/v1.6.2.

The following happens after I click on Download

-> GET https://github.com/java-decompiler/jd-gui/releases/download/v1.6.2/jd-gui-osx-1.6.2.tar
<- 302, Location https://github-production-release-asset-2e65be.s3.amazonaws.com/32844456/17ad4180-9b20-11e9-8a7f-1d014f885195?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190630%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190630T095540Z&X-Amz-Expires=300&X-Amz-Signature=565de0f5426fc0fb0232c50116f9516871e78f11e67221039dc4bb41c9a1d73f&X-Amz-SignedHeaders=host&actor_id=185025&response-content-disposition=attachment%3B%20filename%3Djd-gui-osx-1.6.2.tar&response-content-type=application%2Foctet-stream, 
Content-Type:
text/html; charset=utf-8 …

-> GET https://github-production-release-asset-2e65be.s3.amazonaws.com/32844456/17ad4180-9b20-11e9-8a7f-1d014f885195?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190630%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190630T095540Z&X-Amz-Expires=300&X-Amz-Signature=565de0f5426fc0fb0232c50116f9516871e78f11e67221039dc4bb41c9a1d73f&X-Amz-SignedHeaders=host&actor_id=185025&response-content-disposition=attachment%3B%20filename%3Djd-gui-osx-1.6.2.tar&response-content-type=application%2Foctet-stream
<- 200, Content-Disposition:
attachment; filename=jd-gui-osx-1.6.2.tar, Content-Type:
application/octet-stream

Although the content disposition header is set correctly the file is still downloaded with name 17ad4180-9b20-11e9-8a7f-1d014f885195 instead of file name jd-gui-osx-1.6.2.tar.
Evrything works fine in Safari and Firefox.
Chrome also emits the following warning in the log
Resource interpreted as Document but transferred with MIME type application/octet-stream: “https://github-production-release-asset-2e65be.s3.amazonaws.com/32844456/17ad4180-9b20-11e9-8a7f-1d014f885195?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20190630%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190630T095540Z&X-Amz-Expires=300&X-Amz-Signature=565de0f5426fc0fb0232c50116f9516871e78f11e67221039dc4bb41c9a1d73f&X-Amz-SignedHeaders=host&actor_id=185025&response-content-disposition=attachment%3B%20filename%3Djd-gui-osx-1.6.2.tar&response-content-type=application%2Foctet-stream”.

Cannot reproduce with latest Chrome, same OS and version as you.

1 Like