Scott Hanselman

How to allow executable .exe files to be downloaded with ASP.NET Core and UseStaticFiles middleware

November 03, 2020 Comment on this post [9] Posted in ASP.NET | DotNetCore
Sponsored By

In the long process of upgrading this blog and moving it to Azure I've been slowly fixing small bugs and also dealing with the dozens of microsites I have hanging off of Some were forgotten, and some just keep chugging along. is one of them.

BabySmash is a silly WPF app I wrote 15 years ago for my baby, natch. He's now learning to drive a car, but it still gets thousands of downloads a month. The code is on Github.

The ClickOnce application and manifests hangs off of, but the /setup.exe returns a 404.

I had assumed that using this simple code in my Startup.cs's Configure() method would enable static files like setup.exe:


This was naive I suppose as ASP.NET Core is very much locked down by default so you are really encouraged to be specific and there are few unsafe defaults.

UseStaticFiles includes a parameter for options, so I needed to update the list of mappings from extension to mime/type. So this little helper function:

private StaticFileOptions GetStaticFileOptions()
var p = new FileExtensionContentTypeProvider();
p.Mappings[".exe"] = "application/octet-stream";
return new StaticFileOptions { ContentTypeProvider = p };

and then you pass that StaticFileOptions class into UseStaticFiles.


Clearly a "secure by default" decision, but also one that's easily extended for my needs.

Sponsor: Suffering from a lack of clarity around software bugs? Give your customers the experience they deserve and expect with error monitoring from Installs in minutes, try it today!

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Hosting By
Hosted in an Azure App Service
November 06, 2020 7:51
Scott, small typo in the MIME type - octet-stream. Thank you for the article.
November 06, 2020 9:25
test <strong>test</strong> and test <u>test</u> <a href="test">test</a>
<pre><script>var i = 2;</script></pre>
November 06, 2020 9:37
And here I thought I am the only one testing on production server..., I feel better now... 😂
November 06, 2020 9:45
test test and test test test
<script>var i = 2;</script>
November 06, 2020 9:46
Rosdi! Don't tell! ;)
November 06, 2020 12:47
Hi, this babysmash tool is really a good idea! Congrats! Also I gone to see your site and just one stuff was giving to me a 404 error : it's when I click on the button "home" which redirect to "". Perhaps it's a stuff pending and I would just indicated this behavior.
November 06, 2020 18:15
Now all you need to test is if bots can solve the maths problem 😉
November 08, 2020 13:55
Great tip. Good to see that doing stuff like downloading .exe file is easy to accomplish in .NET Core.
November 08, 2020 21:45
Many thanks for this nice article. I learned a lot while reading.

Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.