Is this an optimal way to prevent the IE8 security banner from appearing when the user downloads a file?

Question

I set the src attribute of an iframe to a download url and then I use appendChild to add the iframe to the body of the page to trigger the download. If the url of the download is fully qualified, ie "http://example.abc.com/download/" then the download will trigger the security bar. If the url is "http://example/download/" the download goes through without the security bar.

Could someone explain how and why this is happening? I understand that IE8 throws the security bar up when the page tries to download a file from a url that is different than the page url, but I wouldn't think it would be this picky. Also, the current page url is fully qualified so I would think the results I'm getting would be reversed.

Is it a good solution to just chop out a portion of the full domain in order to avoid the security banner?

Answer 1

The easiest way to avoid the security warning is by opening the download URL in a new window instead of an <iframe> .

For example:

HTML:

<a href='//www.example.com/your_download' onclick='init_download(this.href);return false' target='_blank'>Test</a>

JavaScript

function init_download(link) {
    window.open(link, '_blank', 'toolbar=0,location=no,directories=0,status=0,scrollbars=0,resizeable=0,width=1,height=1,top=0,left=0');
    window.focus();
}

↪ View this example at JS Bin