FileDownload: cannot download file with http connection on firefox 125+

[wbss1]

Describe the bug

Hello, it's no longer possible to download files using an http connection with the new download protection on firefox (version 125+). The files are downloaded, but they are not complete. This problems affect all version of primefaces.

Here it's the log error
error download file.txt

Reproducer

Firefox Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1894667

Expected behavior

Correct download of file

PrimeFaces edition

None

PrimeFaces version

all

Theme

No response

JSF implementation

Mojarra

JSF version

2.3

Java version

8

Browser(s)

Firefox 125.0.1

[jepsar]

Are you using Ajax or non-Ajax downloading? Please include a reproducer.

[github-actions]

Please provide an executable example using the PrimeFaces Test project. This issue will be closed if no activities in 20 days.

[wbss1]

Here it's the reproducer.
For the test you need to not use localhost, you must use the ip.
With ajax works, with ajax false not.
pf-test-download-firefox.zip

[jepsar]

It just allows me to download it after pressing a button.

[jepsar]

Hmm.. it is broken after download though. I guess it's a FF issue.

[wbss1]

Yes it is almost always in ssl, but if the application is only used on the local network it is not. Example: private server for internal use.
If you click on allow the download and open the file, you will see that it is damaged.

Chrome applies the same policy, but the file is downloaded successfully

[melloware]

@wbss1 i would start scanning the Mozilla bug list to see if this has been reported...

[melloware]

Found this bug from 11 years ago it was the same issue with Virus Scanner in their downloads corrupting Firefox files: https://support.mozilla.org/en-US/questions/893054

[melloware]

OK type about:config in your browser bar and disabled these settings and downloads work. Its definitely a Firefox bug.

[wbss1]

Seems like that disable dom.block_download_insecure it's enough.
I will try to report it with bugzilla

[melloware]

Yep it looks like it!

[wbss1]

I reported it on bugzilla https://bugzilla.mozilla.org/show_bug.cgi?id=1892115

EDIT: Bug tracked here: https://bugzilla.mozilla.org/show_bug.cgi?id=1894667

[melloware]

Looks like quite a few bugs around that insecure SSL feature: https://bugzilla.mozilla.org/show_bug.cgi?id=1892069 Doesn't look like they tested it enough 😄

[melloware]

Firefox 126.0 is out can someone test it to see if its fixed?

[wbss1]

In Firefox 125.0.2 they disable the HTTP download protection mechanism and they are working for fix the bug (https:///bugzilla.mozilla.org/show_bug.cgi?id=1894667)

I hope they will follow this comment and implement a solution like Google Chrome "Would it be possible to keep the response/content in a temporary location? Then if the user accepts the download the answer can be saved, otherwise it is deleted.

I’m not familiar with the implementation, but Firefox already writes a temporary . part file while downloading, so maybe this could be used, and is renamed only when the user accepts the download, and deleted otherwise."
but seems that they want to block the request and re-submit it again later when the user accept the download. Obviously the POST requests are not idempotent, so they are working on it.

[melloware]

OK @wbss1 i will close for now as nothing PF can do for this issue.