Does Safari on iOS refuse to download `application/octet-stream` content? - ios

Question

I have a Web server written on top of your standard http module in Node.js. It's been working like a clock for me for serving all kinds of HTML, JavaScript, CSS, and asset content -- making up the bulk of my web pages, naturally.
When the service is requested a URL that maps to a file with an unknown extension (there is no MIME sniffing going on), it simply serves content using chunked transfer encoding with the header Content-Type: application/octet-stream, which has been working wonderfully as well -- I occasionally host files of all kinds on the server and am able to download these without any interference from the user agent, as I'd expect from application/octet-stream handling.
Today, however, I tried to download on a Safari mobile browser running on iOS 9.3.5 on an iPhone 4S, and that thing just plain refused to download from a valid URL, alerting me with:
Download failed. Safari cannot download this file.
I've since tried to add Content-Disposition: attachment and also Content-Disposition: attachment; filename="foobar" for good measure, but it still refuses.
This has been the case with a file called random which is filled with 1000 random bytes. My host headers are (Content-Disposition is optional, as said above):
HTTP/1.1 200 OK
Host: example.com
Content-Type: application/octet-stream
Content-Disposition: attachment; filename="foobar"
Date: Mon, 01 May 2017 13:48:37 GMT
Connection: keep-alive
Transfer-Encoding: chunked
For the record, Android 6.x phone also behaves as expected (in addition to Firefox 53 on my Windows 10 x86_64 host), downloading from the URL without a hitch.
What's going on with Safari here?

Answer 1

Yes, the only thing you can download with Safari on iOS is image. This is because iOS does not expose file structure to user (download file to somewhere user can never see does not make any sense), it has nothing to do with anti web attack. Browser on Android can download arbitrary files because Android file structure is visible to user.
Here is a previous discussion on Apple community: https://discussions.apple.com/thread/3697948?start=0&tstart=0
The ONLY thing you can save to an iPhone, from Safari, is a pic. Nothing else, and no downloads.
It is possible that iOS supported video files can be downloaded in future, but it is unlikely for arbitrary files with application/octet-stream MIME type.

Answer 2

After I have spent so much time trying to find the solution, I came with this solution:
Replace the octet-stream with pdf.
<?php
$file = 'data/report/foobar.pdf';
header('Content-Description: File Transfer');
header('Content-Type: application/pdf');
header('Content-Disposition: attachment; filename="'.$file.'"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: '.filesize($file));
readfile($file);
?>