I have a PHP app that creates a CSV file which is forced to download using headers. Here\'s the relevant part of the code:
header(\'Content-Type: applicatio
I found one workaround for this that relies on javascript, so it's not exactly secure, but for non-secure critical sites it seems to work.
Have a form with a button titled 'download' with the action set to point to the download script, then using javascript put something on the onsubmit handler that strips out the download button and replaces the messaging on the screen. The download should still happen and the screen will change. Obviously, if there's an issue with the download script then it still looks like the download was successful even if it doesn't fire, but it's the best I've got right now.