Cache xml files without application/octet-stream type

Question

Is it possible to DiskCache non-image files without losing their type when rendered in the browser?

I followed the instructions on this page: http://imageresizing.net/docs/v4/howto/cache-non-images

Per the instructions, I set PostAuthorizeRequestStart = True and cache = Always in the PostAuthorizeRequestStart event. I also added the .unknown mimeType in the config.

However, when an xml file is requested, it's returned as content-type "application/octet-stream" instead of "text/xml".

Is there anyway to preserve the original content-type of non-image files?

Answer 1

I'm afraid not - at least not without modifying ImageResizer source code.

We made the decision to prioritize security, and save all files with the ".unknown" extension to prevent them accidentally being executed as scripts by IIS. IIS sends the content-type based on the file extension, and (depending on your IIS configuration), the extension determines if the file should be executed as code.

I see no harm in expanding the "whitelist" of extensions to include non-image file types, as long as we're reasonably confident that other users haven't allowed IIS to consider those file types executable.

The code that would need to be modified (in v4+), would be HttpModuleRequestAssistant.EstimateResponseInfo . Instead of falling back to "unknown" immediately, a second whitelist could be consulted.

If you file an issue on GitHub about this, you can subscribe to notifications. We'd definitely accept a pull request addressing this feature request, particularly during the current v4 prerelease phase when changes to the pipeline are less risky.