Delayed download with Web Security.cloud

Products

• Web Security.cloud

Issue/Introduction

You find that some larger  files have a small delay at the beginning of downloading.

Cause

The Web Security Service has a feature called "slow streaming" to protect customers from malicious files that can infect networks. The feature is required because under certain conditions, the default streaming behavior (of streaming back content before scanning completes and holding back the last portion of that content if it is found to be malicious) can result in the delivery of a partial file containing active malicious content that could still be extracted. To protect against this, the service will slow-stream or "trickle" a response to the browser when specific file types are detected by inspecting the Content-Type HTTP header and/or the leading bytes of the response body. As a result, for these file types, the user will not see a download progression bar until the scanning completes, but they will see a Web Security Service block page if the request is blocked. The delay corresponds to the download and scanning time, which will be larger for larger files.

The following file types will trigger the slow streaming behavior in the Web Security Service:

• application/x-rar
• application/x-rar-compressed
• application/x-executable
• application/x-sharedlib
• application/x-object
• application/x-coredump
• application/x-dosexec
• application/x-kdelnk
• text/xmcd

Resolution

This is expected behavior and by design. It is worth noting that some firewalls and browsers may timeout if no response is delivered within a configured time. If this is the case, it is recommended that the configured timeout values be increased for those devices and applications.