How to sniff HTTP response headers in Chrome? for "attachment" content?

Question

Usually I'm able to sniff my HTTP requests using Chrome Dev Tools - network tab.

But it's not happening for download-files (i.e. when Content-Dsiplosition is set to Attachment;filename=xxx) - then Chrome just downloads the file and nothing is shown on the network tab.

How do I see those? I mean, in Chrome, without any 3rd party tools like PostMan.

PS. I need to see the headers my server sends, there's some debugging info I need.

Solution 1

When I try to paste an URL pointing to a downloadable file, directly into the browser address, it doesn't show anything on the network tab.

However, I've found a workaround that suits my use case. Create an .html file anywhere, and just create a link to that attachment (an alternative is to just open about:blank in the browser and edit the HTML in place).

<a href="https://example.com/example.ambiguous.file">download</a>

Then open that .html file and click on the link.

This causes the network tab to display the file you're trying to download, and so the headers.

In my case I was able to troubleshoot how the Content-Disposition headers was never sent to specific browsers.

---

EDIT (2017-11):

If this doesn't work with recent versions of Chrome, try putting it in an image tag. The objective is to sniff the HTTP response headers, not the content.

<img src="https://example.com/example.ambiguous.file">download</img>

Solution 2

You can view them in FireFox: F12 then Network tab

Solution 3

You can view them from the Headers tab.

The response body itself is the file being downloaded and you will not be able to see it from the Response tab, but I can see the response headers from the Headers tab, check the picture:

Comments

[jazzcat]

My whole "network" tool is empty. There are no requests listed there

[Hay]

@ViRuSTriNiTy I tried my answer and surprisingly I can't seem to make it work anymore. I have updated the answer with an alternative approach of putting it in an img tag. (I did not succeed with JavaScript window.open, and AJAX is blocked by CORS)

[SimZal]

This indeed seems to be the easiest solution. You can cancel the download and look at headers.

[shivam13juna]

After opening network console, you've to refresh the page.

[Paul Leclerc]

@shiva If you refresh the pdf page after opening the devtools (automatically in a new page), its closed by itself.

[mistertodd]

You will notice that Set-Cookie is always missing - and view source option itself is also now missing from Chrome completely.