Why don't I always see IE's "Internet Explorer blocked this site from download files..."?

Question

I see there are several questions regarding how to deal with IE's 'protect your security, Internet Explorer blocked this site from downloading files to your computer. ' toolbar. My problem is that I have two different tools that I use to download files and one, when a 'trusted' site with medium security in IE8 downloads file just fine. The other tool will not download the file.

The headers for the failed download: (failed means a download file security message shows up)

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Disposition: attachment; filename="file.xls"
Content-Type: application/vnd.ms-excel
Transfer-Encoding: chunked
Date: Tue, 05 Oct 2010 16:19:08 GMT

the headers for the other download:

HTTP/1.1 200 OK
Date: Tue, 05 Oct 2010 16:23:41 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Disposition: attachment; filename="excel_report.xls"
Content-Length: 55808
Connection: close
Content-Type: application/vnd.ms-excel;charset=ISO-8859-1

Both downloads are coming from the same domain, they are different web application contexts.

I have tried putting content-length in the first, and event some Pragma headers I've seen bandied about on some sites.

If this rings any bells for someone I'd be much obliged.

Answer 1

Generally IE's security toolbar shows up because of how the request was made, rather than what the response looks like.

The most common time that I have run into this is when files are downloaded by requests that were initiated by JavaScript. Its tough to be 100% sure, but I would start looking there.