get_temporary_link with zip files causing Google Chrome warning

Thanks for the report. I just tried this myself and I was able to reproduce this warning in Chrome with a temporary link to a zip file with some junk in it. A txt file worked fine for me though as well.

I also accessed my two temporary links directly, and the only differences seem to be, aside from the file data itself:

• the "Content-Type" header: "application/zip" vs. "text/plain; charset=utf-8"
• the lack of the "Vary: Accept-Encoding" header
• the "x-dropbox-request-id" header value (both randomly generated)
• the "etag" value (though this is opaque anyway) 
• the "content-disposition" header "filename" value: reflecting the respective file name and extension for each, ".zip" vs. ".txt"

Of those, I think it's likely the "Content-Type" and/or the "content-disposition" that Chrome is suspicious of (since .zip could potentially hide something more dangerous than .txt would), perhaps combined with different levels of trust of the Dropbox API server host as compared to others like S3.

Unfortunately, it doesn't look like there's anything for us to fix on our side, since the HTTPS response is valid in both cases, and the logic for this warning is controlled by Google of course. Dropbox also doesn't offer ways to configure the specifics, e.g., the headers, of the response (though we don't know what specifically is causing Chrome to decide to show this anyway).

I'll raise this with the team, but I can't promise if this is something we'd be able to resolve. You may wish to raise this as an issue with Google.