html - How do I download files from my Django website?

Question

I have a small django website that allows file uploading hosted on pythonanywhere. The files are uploaded to aws s3.

Now the problem is that even with the presence of download attribute in the html, the browser still renders the file instead of downloading it

<a download href="{{file_url}}">Download</a>

Answer 1

From Mozilla Developer Network Anchor element reference:

"....download only works for same-origin URLs, or the blob: and data: schemes..."

Your aws s3 links most probably are not same-origin (same domain etc) as your site.

If that is what you are running into, one work around that comes to my mind is, you can make on your site a transfer url that receives the document identifier, downloads from aws s3, and then forwards its content as response. This way you can also control content-type like headers that you may need to explicitly set to make the browser behave the way you want.

One addition, if you decide to have a solution like that, you have to take precautions to control the request content that transfer url, and only transfer content that your web site intended to. Otherwise you will have opened a vulnerability similar to what is called an "Open Redirect" vulnerability.