Skip to main content

Use octet stream downloads


The system should download files coming from untrusted sources, such as user-uploaded files, using octet stream downloads.


User-uploaded files should generally be considered to be untrusted input. If the appropriate Content Security Policy is not set when opening a file, browsers may render it and interpret potentially malicious code. Therefore, user-uploaded files should be served by either octet stream downloads, or from an unrelated domain, such as a cloud file storage bucket. This reduces the risk of XSS vectors or other attacks from the uploaded file.

Supported In

This requirement is verified in following services




free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.