Tim Blair

Using Apache mod_headers to Change Downloaded Filenames (16/06/2005)

A system we've been developing for a while now requires that the user downloads a file that's generated based on information they input. In the past this hasn't been a problem because we've always served the file up as a ZIP file which the user manually extracts and runs. However, a recent client wanted the ability to download a single EXE to save staff having to unzip the file themselves. Generating the EXE was easy enough — we just used the command-line version of WinRAR to create the self-running archive.

The next problem we came up against was that the users run on a restricted service which doesn't allow running of random EXE files. All our generated files are created as {UUID}.exe and stored -- obviously this wasn't going to work. We came to an agreement with their IT department that all downloads would be of a fixed name (in this case it would be HRP.EXE) and they would enable running of that named EXE on the machines. All good, but how to serve up the files with the correct name? We could just create the downloaded archive on-the-fly every time someone needed to download it, but this would completely negate the benefit of storing the files once generated.

My initial thought was to use ColdFusion and <cfheader>:

<cfcontent type="application/unknown"> <cfheader name="Content-Disposition" value="attachment; filename=#uuid#.exe">

However, I am always averse to this method of downloading, especially when we could be looking at 10Mb+ downloads for each file. Each download would lock up a single CF thread for however long the download took; some users will be on dial-up and could be there for a while! So a better solution was needed.

We were sure there must be some method of modifying the header information using Apache — after all, mod_rewrite is used for URL rewriting coming in, so why wouldn't there be a similar module for modifying the HTTP headers as the file went back? And indeed there is: mod_headers to the rescue! Using a combination of this module and the Apache core functions, I was able to force all EXE files to be downloaded with a fixed filename, while leaving all other filetypes untouched. Here's how it happens:

In the main Apache httpd.conf file we have to make sure that mod_headers is successfully loaded, and that we have the ability to use .htaccess to use the module correctly:

LoadModule headers_module modules/mod_headers.so ... <Directory /> AllowOverride All </Directory>

Next, all that's required is an .htaccess file in the correct directory which updates the Content-Disposition to force the file to be downloaded with the correct filename. Note that we also use the Apache core <Files> directive to limit this rewrite to only EXE files.

<IfModule mod_headers.c> <Files "*.exe"> Header set Content-Disposition "attachment; filename=HRP.EXE" </Files> </IfModule>

So we now have all EXEs downloaded with the correct filename, with no codebase changes!

Article Archive (September '03 – '05)

• Private CFC Methods and "this" 01/09/2003
• Active Sessions Across CF Applications 12/09/2003
• isnumeric() - Too Clever for It's Own Good? 15/03/2004
• Modifying Page Generated Content 15/03/2004
• CF and Arrays of Basic Java Types 17/03/2004
• Writing UTF-8 Text Files with ColdFusion 13/05/2004
• Top vs. Bottom Posting 09/07/2004
• Local (var) Scope Shortcut 27/12/2004
• Using Apache mod_headers to Change Downloaded Filenames 16/06/2005
• Changing the Working Directory of <cfexecute> 12/07/2005
• Flickr Workshop Review 29/09/2005