Force File Download prompt in IE for .NET executable?

Question

We have a .NET executable that we are hosting on a web server. The domain for the web server is set as a "Trusted Site" on the user's IE.

When the user left clicks the link for the executable, it blows up with the error: "Microsoft IE Execute shell has encountered a problem and needs to close". From what I have read, it is because IE is trying to execute the file directly using ieexec.exe.

What is desired, is the user should get a pop-up box with a security warning asking them if they want to download the .exe, and buttons "Run" "Save" "Cancel". Not a cryptic security exception. The workaround is to right-click and click on "Save Target As..".

Of course, this only blows up in IE, not Firefox or Chrome.

How can I compile the .NET executable to bypass this ieexec.exe and force the file download prompt?

Answer 1

It may not be the easiest solution, but I believe it should work: redirect the file to a script, and have that script set the content-disposition header and output the file. In case that wasn't clear, I'll provide a step-by-step below. In the step-by-step I'll assume usage of an apache with php environment, but the same should be possible in any decent environment.

First, we will set up a mod_rewrite rule on your web server to have the download get passed to a php file:

.htaccess

RewriteEngine On
RewriteRule ^file.exe$ file.php

Then, we will make have the php file set the appropriate headers, include the content-disposition header and include the file.

file.php

<?php

header("Content-disposition: attachment; filename=file.exe");
header("Content-type: application/octet-stream");

require 'file.exe';
?>

And that should tell the browser not to consider anything other than downloading it. I haven't tried if IE respects the header correctly, but this way you are telling it to download the file in question.

Answer 2

Without knowing what specific .NET technology you have access to, it is difficult to be sure of an answer, however, you may find this helpful.

If you are serving the content in ASP.NET, you can set the content disposition and content type to encourage correct treatment from the browser:

Response.AppendHeader("content-disposition", "attachment; filename=myexe.exe");
Response.ContentType = "application/octet-stream";

Here is an old, but reasonably applicable example online of controlling the HttpResonse in ASP.NET:

http://aspalliance.com/259