Take the 2-minute tour ×

We have a web site that makes several PDFs available for download. The PDFs might be static, or dynamically generated. They are downloaded using one of several mechanisms (static-URL, post back/redirect/meta-refresh/etc.). For certain PDF files, Chrome downloads them without complaint. For others, it warns the user that "This type of file can harm your computer. Are you sure you want to download ..." and requires an extra click.

What information is Chrome using to decide whether to show the message? Obviously, it's not simply the fact that the file is a PDF.

To be clear, I want to do something on the server side (we use IIS/ASP.NET, if it matters) to prevent the message from ever appearing. I'm not interested in a solution that has each user disable the message in their browser (if that's even possible).

Thank you.

share|improve this question
add comment

7 Answers

up vote 20 down vote accepted

TL;DR: Chrome has a variety of client-side heuristics used to determine a file's safety. I don't believe there's anything you can do to ensure that a file is marked "safe", but I'll point at some things that might help.

A good amount of logic goes into determining whether or not that prompt should be shown. Happily, Chromium is open source, so that logic is available for you to peruse. I'm not incredibly familiar with the download code, but the best place to start would almost certainly be ChromeDownloadManagerDelegate::IsDangerousFile. That ends up calling out to download_util::GetFileDangerLevel and download_util::IsExecutableMimeType which seem to be where the checks against mime types and paths live.

Based on a quick read, I'd imagine that the redirects are at least part of the cause, as those aren't directly related to a user gesture. Clicking directly through to the download is "safer" in this context than clicking on something, and being redirected through a variety of trackers and dispatchers, as the user can't be expected to follow along.

The heuristic also takes into account whether you've been to a particular URL or domain before; that could also have an impact on certain files showing up as "safe" and others not.

share|improve this answer
I've noticed that some reasons for this message may be: 1) spaces in file names and 2) the extension being capitalized. After I fixed those two problems, the warning went away (for my application). –  SyntaxRules Oct 2 '13 at 16:03
add comment

You could try content-disposition: inline instead of content-disposition: attachment (see http://code.google.com/p/chromium/issues/detail?id=65895)

share|improve this answer
Good find. It looks like the auto-open behavior actually regressed in Chrome 13, and will be fixed in Chrome 15: crbug.com/92345 This only effects users who have set PDF files to auto-open in some specific program, but that might well suit the OP's use-case. –  Mike West Sep 18 '11 at 8:06
add comment


I managed to get rid of it :-)

At first tested opening the PDF in the Console. I also tried a timeout which didn't help, but it did give me a msg the 1st time (This site is attempting to download multiple files. Do you want to allow this?).

setTimeout( function(){ /* export */ }, 0 );

What does work for me is to directly attach it to a click event.

document.getElementById("expButton").addEventListener( "click", function() { /* exp.. */ } );

I guess pure javascript exports don't work the same as actual events, maybe you could properly initiate an event, first.. I'm currently not to try.

p.s. I have NOT checked (settings/downloads) 'Ask where to save each file before downloading', but either way it's alright.

Just because this might be helpful:
I used ReportViewer and it had an export function. If I click it it works fine, but I wanted to export when I clicked my custom DIV:


I tried to invoke it via console and nothing was visually happening, unless you open the downloads page (Ctrl-J):

pure js invocation

Then I tried it with the before mentioned timeout, but again undesired behaviour: pure JS with timeout

Then I tried to attach it to an actual click, which actually resulted in the below 2 different situations, that I cannot explain or will investigate further.

    function() {

Weird weird

Desired success

And I'm wondering if you could actually simulate this with events. I have tried to make the simple JS event, but it didn't work.

share|improve this answer
add comment

I came across a similar problem in Chrome.

My site filled a pdf document with some data and returned that pdf for the user to save.

The page returned the generated pdf document as an attachment:

Response.ContentType = "application/pdf";
Response.AppendHeader("Content-Disposition", "attachment; filename=" + aOutputFileName);

The link for the pdf download had a target="_blank" attribute defined:

<a href="CreatePdf.aspx" target="_blank">Your pdf</a> 

Removing the target attribute from the link also removed the warning when users clicked on said link.

share|improve this answer
Removing the target="_blank" actually solved my issue :) –  Lionel Chan Nov 5 '13 at 1:56
add comment

I would guess that Chrome is probably warning you on the dynamically generated PDF's, although not entirely sure.

The reason for that is that PDF's can be created to contain executable code which can be executed when there is a hole (buffer overflow or some such exploitable hole) in the reader opening it. PDF's like that are generated by tools, where you specify what code to embed etc, and so that's where my suspicion comes from that the dynamically generated files are causing that message box.

share|improve this answer
add comment

I don't know for sure but my guesses are:

  1. The server returns the wrong content type for the file (i.e. "test/html" instead of "application/x-pdf"). Some hacked sites try to send you screen blankers (*.scr) telling you "this is pr0n! Open it right now!". Double clicking the file will install a virus on your computer.

  2. The PDFs contain JavaScript, possibly encrypted JavaScript.

share|improve this answer
add comment

Actually if you use events this always going to happen if you programm a simple link () you can avoid that check and you can get your automatic download

share|improve this answer
add comment

Your Answer


