Scott Hanselman

How to allow executable .exe files to be downloaded with ASP.NET Core and UseStaticFiles middleware

November 03, 2020 Comment on this post [9] Posted in ASP.NET | DotNetCore
Sponsored By

In the long process of upgrading this blog and moving it to Azure I've been slowly fixing small bugs and also dealing with the dozens of microsites I have hanging off of hanselman.com. Some were forgotten, and some just keep chugging along. https://www.babysmash.com/ is one of them.

BabySmash is a silly WPF app I wrote 15 years ago for my baby, natch. He's now learning to drive a car, but it still gets thousands of downloads a month. The code is on Github.

The ClickOnce application and manifests hangs off of http://hanselman.com/babysmash, but the /setup.exe returns a 404.

I had assumed that using this simple code in my Startup.cs's Configure() method would enable static files like setup.exe:

app.UseDefaultFiles();
app.UseStaticFiles();

This was naive I suppose as ASP.NET Core is very much locked down by default so you are really encouraged to be specific and there are few unsafe defaults.

UseStaticFiles includes a parameter for options, so I needed to update the list of mappings from extension to mime/type. So this little helper function:

private StaticFileOptions GetStaticFileOptions()
{
var p = new FileExtensionContentTypeProvider();
p.Mappings[".exe"] = "application/octet-stream";
return new StaticFileOptions { ContentTypeProvider = p };
}

and then you pass that StaticFileOptions class into UseStaticFiles.

app.UseStaticFiles(GetStaticFileOptions());

Clearly a "secure by default" decision, but also one that's easily extended for my needs.


Sponsor: Suffering from a lack of clarity around software bugs? Give your customers the experience they deserve and expect with error monitoring from Raygun.com. Installs in minutes, try it today!

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Hosting By
Hosted in an Azure App Service
November 06, 2020 3:51
Scott, small typo in the MIME type - octet-stream. Thank you for the article.
November 06, 2020 5:25
test <strong>test</strong> and test <u>test</u> <a href="test">test</a>
<pre><script>var i = 2;</script></pre>
November 06, 2020 5:37
And here I thought I am the only one testing on production server..., I feel better now... 😂
November 06, 2020 5:45
test test and test test test
<script>var i = 2;</script>
November 06, 2020 5:46
Rosdi! Don't tell! ;)
November 06, 2020 8:47
Hi, this babysmash tool is really a good idea! Congrats! Also I gone to see your site and just one stuff was giving to me a 404 error : it's when I click on the button "home" which redirect to "https://www.babysmash.com/index.htm". Perhaps it's a stuff pending and I would just indicated this behavior.
ben
November 06, 2020 14:15
Now all you need to test is if bots can solve the maths problem 😉
November 08, 2020 9:55
Great tip. Good to see that doing stuff like downloading .exe file is easy to accomplish in .NET Core.
November 08, 2020 17:45
Many thanks for this nice article. I learned a lot while reading.

Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.