Internet Explorer No Open

Written by Ulises Gascón

Apr 08, 2020 — 1 min read

The attack

This attack only affects old versions of Internet Explorer.

Some web applications will serve untrusted HTML for download. For example, you could allow users to upload and download HTML files.

By default, old versions of Internet Explorer will allow you to open those HTML files in the context of your site, which means that an untrusted HTML page could start doing bad things in the context of your pages. For more, see this MSDN blog post.

The header

The X-Download-Options header can be set to noopen. This will prevent old versions of Internet Explorer from allowing malicious HTML downloads to be executed in the context of your site.

The code

This middleware sets the X-Download-Options to prevent Internet Explorer from executing downloads in your site’s context.

const helmet = require('helmet')

// Sets "X-Download-Options: noopen".
app.use(helmet.ieNoOpen())

Refs: