The Bugzilla issues don't seem to rule-out the possibility of using CORS for cross-origin download attribute support in the future, but right now using CORS headers does not do anything for the download attribute. It's possible that if other browsers start supporting the attribute, a consensus may yet be reached.

This actually is possible with JavaScript, though browser support would be spotty. You can use XHR2 to download the file from the server to the browser as a Blob, create a URL to the Blob, create an anchor with its href property and set it to that URL, set the download property to whatever filename you want it to be, and then click the link. This works in Google Chrome, but I haven't verified support in other browsers. window.URL = window.URL || window.webkitURL; var xhr = new XMLHttpRequest(), a = document.createElement('a'), file; xhr.open('GET', 'someFile', true); xhr.responseType = 'blob'; xhr.onload = function () { file = new Blob([xhr.response], { type : 'application/octet-stream' }); a.href = window.URL.createObjectURL(file); a.download = 'someName.gif'; // Set to whatever file name you want // Now just click the link you created // Note that you may have to append the a element to the body somewhere // for this to work in Firefox a.click(); }; xhr.send();