I have a page that contains a Page Viewer web part. Each time the page loads, in both edit and view modes, I get a File Download dialog box asking "Do you want to save this file?", listing the correct filename to which I'm linking (e.g., foo.htm) with "yes" and "cancel" options. In the dialog box, the file is correctly identified as an HTML document.

I'm stumped. I cannot find any checkbox or settings to choose to "open html documents in browser" for the site, the page nor the library where the page is stored. While I can successfully override the "strict" rules for file handling, I'd be interested to know what, specifically, SP is seeing as a "rejection criterion" under strict rules. I'd prefer to fix that problem (which may be as stupidly simple as making sure all our files are *.html instead of *.htm, migrating the docs from a doc library to a wiki library etc.)

Has anyone else ever encountered this? Any hints or suggestions about what I can do to fix this?


  • Thank you for suggesting renaming the file to *.aspx Worked like magic... amazing... THANK YOU! Jun 15, 2017 at 13:11

2 Answers 2


Both the description and the solution of your issue can be found here : Unable to Open PDF Directly from SharePoint 2010 ([Link edited on 11/20/2013].

Basically, it's a security feature (that can be disable, if you accept the implication), that prevent some files to be displayed in the browser directly. Typically, what would prevent someone to put some javascript in the html file and gain privileges of the viewing user?

If you are ok with that, as the article state :

You can modify SharePoint’s behavior by changing the Browser File Handling option in the Web Application General Settings of SharePoint 2010. Your options are permissive and strict, with strict being the default.

Set it to permissive, and this should works.

I don't know your requirement, but can you imagine an alternative, like using direct html content in publishing and / or wiki pages ?

[Edit] There's a cleaner way to workaround this behavior. Instead of disabling this security settings, you should allow only mime types you want to allow to be seen in the browser.

The allowed mime types are defined in the SPWebApplication.AllowedInlineDownloadedMimeTypes Property

Here is small PowerShell utility function I use:

function Add-SPAllowedInlineDownloadedMimeType{
        [Parameter(Mandatory=$true, Position=0, ValueFromPipeLine=$true)]
        [Parameter(Mandatory=$true, Position=1)]
        $actualWebApp = $WebApplication.Read()
        if ($actualWebApp.AllowedInlineDownloadedMimeTypes -notcontains $mimetype)
           Write-Host "Adding MIME Type..."
           Write-Host "Done."
        } Else {
           Write-Host -ForegroundColor Green "MIME type is already added."

And it can be used like this:

Add-SPAllowedInlineDownloadedMimeType -WebApplication http://mywebapp -MimeType "text/html"
  • 1
    corporate Intranet, only three people have upload/edit permissions, and we've determined that the security risk for those instances is manageable. Not my first choice, but then I'm not the decision-maker either. :)
    – dwwilson66
    Jun 20, 2012 at 12:18
  • 1
    I'm more interested in why HTML files are being rejected. With SP being a web app, rejecting PDFs, and non-html stuff makes sense, but to reject HTML? I'd like to fix whatever's making SP view this as an untrusted file.
    – dwwilson66
    Jun 20, 2012 at 12:24
  • 1
    html is a very easy vector of script injection. As soon as an attacker can contribute to a library, he can inject any javascript he wants, with all access to javascript client object model, with the rights of the connected user (it's the idea of script injection attack).
    – Steve B
    Jun 20, 2012 at 12:26
  • 3
    As some of the comments state in the linked post regarding browser file handling, disabling this security feature by setting to Permissive is like killing sparrows with a cannon (as we say in Denmark;-)! Instead you should change the AllowedInlineDownloadedMimeTypes for the specific mime-type on the relevant web applications Jun 20, 2012 at 13:11
  • 3
    @David: thanks. I replaced the link with an equivalent one. I also improved the answer with a better solution.
    – Steve B
    Nov 20, 2013 at 10:18

Just change the extension to .aspx.

  • Changing the extension to aspx from html worked. if you are not willing to change the extension, Please refer the answer section updated. Jul 23, 2015 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.