File download and browser progress bar

When downloading a file, if you want the browser to show a progress bar indicating the time remaining for download, then include content-length HTTP header in your response. If you do not include content-length header, browser would not indicate the time remaining.

File download file name

I was writing a file download utility in cgi perl and the name of the file downloaded was the same as the name of the perl program used to handle the request. After tinkering around a bit I found out that adding the following HTTP header allows you to give the downloaded file name of your choice.

content-disposition attachment; filename=<your file name>

Cookie fortune

HTTP is a stateless protocol. Stateless means there is no relationship between consecutive requests and response. So how is state maintained? HTTP Cookie to the rescue.

Say you have requested a page from a site www.foo.com. Then all the cookies stored in your browser under foo.com will be sent along with the request. Now say the page you requested from www.foo.com uses a script from site www.bar.com i.e the mark up of the page you requested from www.foo.com has the following in it:

<script src=”http://www.bar.com/js/moo.js”/>

Now when the browser sends a request to www.bar.com for the script moo.js will cookies stored under www.foo.com be sent along with the request? The answer is no. A site gets cookies only which are stored under it’s name. It is not dependent on the referer. When www.bar.com sends the file moo.js to www.foo.com can it send cookies along with the response and if so under which domain will these cookies be set? This depends on your browser security setting i.e whether you have enabled third party cookies in your browser or not. And if your browser allows third party cookies the cookie will be set under the domain www.bar.com and not under www.foo.com .

Say the script moo.js served by www.bar.com contains code to set cookies. Will these cookies be set under www.bar.com or www.foo.com? These cookies will be set under www.foo.com. When your are in domain www.foo.com there is no way to set cookies under another domain say www.bar.com. This is a violation of browser security model.

Read more about cookies here.