I got assigned a rather annoying bug today whereby when a user using Firefox 7 went to a page that streamed a file for download, Firefox immediately stopped processing the page and returned the following error

A little bit of GoogleFu brought me to Firefox Bug #681140 - Corrupted Content error due to multiple Content-Disposition header field instances, new in Firefox 7.

There are a couple of reasons why this error will get thrown but the bottom line is Firefox thinks this is a form of response-smuggling and blocks it, in fact it doesn’t just block it, it denies any knowledge of anything to do with it, I could not for the life of me get Firefox to give me the response headers no matter what extension I used. In the end fiddler revealed the issue

content-disposition: attachment
Content-Disposition: attachment; filename="results.xls"

Fairly simple issue here, there are two Content-Disposition headers being sent to the browser and Firefox 7 throws it’s toys out of the pram if there is more than one.

Now, the cause.

I loaded up the controller that was generating these downloads and right enough, I found

Response.AddHeader("content-disposition", "attachment");
return File(content, format, filename);

I think you can see where I am going here. MVC is pretty good at removing a lot of the boiler plate we normally have to write and this is one of those cases. When you use the Controller.File method a number of headers are automatically set for you on the Response stream, if you provide a file name then one of those headers is Content-Disposition.

Ta-da, the source of the duplication.

So, when using FileResult in MVC, be very careful which additional headers you send out, check them in something like fiddler and don’t just assume that browsers in the future will accept malformed or duplicate headers.