Here's a strange one:

I've got nginx reverse proxying requests to apache 2 with mod\_php.

A user (using firefox 3.1b3) reported that recently, he's started getting sporadic ["What should firefox do with this file?" popups](http://icechewing.huddler.com/imgrepo/f/f1/Image1.jpg) during normal navigation. We haven't had any other reports of this issue, and haven't been able to reproduce it ourselves.

I checked Nginx and apache's logs. Nothing in the error logs, and they both show a normal HTTP 200 for the request.

I had him send me the downloaded file, and it's generated HTML, as it should be -- except it has some trailing and leading bytes tacked on.

The opening byte sequence is the magic gzip header: 1F8B08

Here are the opening characters, C-escaped for convenience:

```
\x1F\x8B\x089608\r\n<!DOCTYPE HTML ...

```

and the file ends with:

```
...</html>\n\r\n0\r\n\r\n

```

When I fetch the same URL via wget, it starts with as expected; the mysterious opening and closing bytes are nowhere to be seen.

Has anyone ever seen anything similar to this? Could this be a FF 3.1b3 bug?