How to encode the filename parameter of Content-Disposition header in HTTP?

Question

Web applications that want to force a resource to be downloaded rather than directly rendered in a Web browser issue a Content-Disposition header in the HTTP response of the form:

Content-Disposition: attachment; filename=FILENAME

The filename parameter can be used to suggest a name for the file into which the resource is downloaded by the browser. RFC 2183 (Content-Disposition), however, states in section 2.3 (The Filename Parameter) that the file name can only use US-ASCII characters:

Current [RFC 2045] grammar restricts parameter values (and hence Content-Disposition filenames) to US-ASCII. We recognize the great desirability of allowing arbitrary character sets in filenames, but it is beyond the scope of this document to define the necessary mechanisms.

There is empirical evidence, nevertheless, that most popular Web browsers today seem to permit non-US-ASCII characters yet (for the lack of a standard) disagree on the encoding scheme and character set specification of the file name. Question is then, what are the various schemes and encodings employed by the popular browsers if the file name “naïvefile” (without quotes and where the third letter is U+00EF) needed to be encoded into the Content-Disposition header?

For the purpose of this question, popular browsers being:

• Firefox
• Internet Explorer
• Safari
• Google Chrome
• Opera

Answer 1

I normally URL-encode (with %xx) the filenames, and it seems to work in all browsers. You might want to do some tests anyway.

Answer 2

If you want it downloaded rather than displayed use the content-type header with the binary octet mime type. Look at the mime RFC for the correct name

Answer 3

There is discussion of this, including links to browser testing and backwards compatibility, in this draft RFC.

RFC 2183 indicates that such headers should be encoded according to RFC 2184, which was obsoleted by RFC 2231, covered by the draft RFC above.

Answer 4

The following document linked from the draft RFC mentioned by Jim in his answer further addresses the question and definitely worth a direct note here:

Test Cases for HTTP Content-Disposition header and RFC 2231/2047 Encoding

Answer 5

There is no interoperable way to encode non-ASCII names in Content-Disposition.

Instead you should use a URL that has filename you want. This trick works:

/real_script.php/fake_filename.doc

and with Apache you can use mod_rewrite to completely change URLs.

Characters in URLs should be in UTF-8, urlencoded byte-by-byte.

Answer 6

What if I don't want to force the SaveAs dialog, but if a user right-clicks on a link and chooses to save the document to disk I want to suggest the file name, can this be done?

Answer 7

Hi, in asp.net mvc2 i use something like this:

return File(
    tempFile
    , "application/octet-stream"
    , HttpUtility.UrlPathEncode(fileName)
    );

I guess if you don't use mvc(2) you could just encode the filename using

HttpUtility.UrlPathEncode(fileName)

greets, Elmer