When I click to download a file through Firefox, a dialog window appears asking me whether I want to save the file somewhere or open it immediately once downloaded.



The OK button in the dialog window starts disabled, and doesn't enable until the dialog has had focus for around a second. The dialog isn't modal, and if I focus on another window the OK button will disable and again won't re-enable until the window has held focus for a second.

My partner lamented at this design, and asked me why she couldn't just click OK to download immediately - I responded that I've always thought it was a security feature. Now that I think about it however, I'm not certain exactly what behavior it could be preventing. I would have thought that it might prevent some malicious website from downloading a file secretly by forcing the download window to stay open for at least long enough to see whats going on - however it should be possible for a site to download stuff secretly in the background anyway. Regardless I presume most users would have clicked the 'do this automatically from now on' box at some point, and thus be unprotected anyway...

So, is this a security feature? If so what does it protect against?

Yes, it is a security feature, and the purpose of the delay is to prevent attacks based around tricking the user into entering input to skip past the dialog by popping it up unexpectedly when the user is in the middle of inputting multiple key presses or mouse clicks in quick succession. The two examples that are given in this blog post explaining the feature are:


A CAPTCHA that asks the user to type the word only. When they press n, a save dialog is popped up, and then the user will immediately press l and then y, which is the keyboard shortcut for OK on some browsers, unintentionally confirming the download
A webpage that convinces the user to double-click somewhere on screen, positioned so that when the dialog opens after the first click, their mouse pointer is right over the "OK" button, meaning that they immediately confirm it.


By disabling the button for several seconds, the input has no effect.

Mozilla bug report about the issue
