views:

8650

answers:

7

Web applications that want to force a resource to be downloaded rather than directly rendered in a Web browser issue a Content-Disposition header in the HTTP response of the form:

Content-Disposition: attachment; filename=FILENAME

The filename parameter can be used to suggest a name for the file into which the resource is downloaded by the browser. RFC 2183 (Content-Disposition), however, states in section 2.3 (The Filename Parameter) that the file name can only use US-ASCII characters:

Current [RFC 2045] grammar restricts parameter values (and hence Content-Disposition filenames) to US-ASCII. We recognize the great desirability of allowing arbitrary character sets in filenames, but it is beyond the scope of this document to define the necessary mechanisms.

There is empirical evidence, nevertheless, that most popular Web browsers today seem to permit non-US-ASCII characters yet (for the lack of a standard) disagree on the encoding scheme and character set specification of the file name. Question is then, what are the various schemes and encodings employed by the popular browsers if the file name “naïvefile” (without quotes and where the third letter is U+00EF) needed to be encoded into the Content-Disposition header?

For the purpose of this question, popular browsers being:

  • Firefox
  • Internet Explorer
  • Safari
  • Google Chrome
  • Opera
A: 

I normally URL-encode (with %xx) the filenames, and it seems to work in all browsers. You might want to do some tests anyway.

Dario Solera
I did test in a few and it does not work that way in all the browsers, thus the question. :)
Atif Aziz
A: 

If you want it downloaded rather than displayed use the content-type header with the binary octet mime type. Look at the mime RFC for the correct name

Javaxpert
No, this is exactly what the Content-Disposition header is for. Read the question, this is about the character encoding of the filename.
Jim
+3  A: 

There is discussion of this, including links to browser testing and backwards compatibility, in this draft RFC.

RFC 2183 indicates that such headers should be encoded according to RFC 2184, which was obsoleted by RFC 2231, covered by the draft RFC above.

Jim
+3  A: 

The following document linked from the draft RFC mentioned by Jim in his answer further addresses the question and definitely worth a direct note here:

Test Cases for HTTP Content-Disposition header and RFC 2231/2047 Encoding

Atif Aziz
+5  A: 

There is no interoperable way to encode non-ASCII names in Content-Disposition.

Instead you should use a URL that has filename you want. This trick works:

/real_script.php/fake_filename.doc

and with Apache you can use mod_rewrite to completely change URLs.

Characters in URLs should be in UTF-8, urlencoded byte-by-byte.

porneL
Anyone know how to do this in ASP.NET? Would it be possible to do something like GetAttachment.aspx?id=34/fake_filename.doc without a lot of trouble?
Yadyn
Try GetAttachment.aspx/fake_filename.doc?id=34 (although it might be Apache-only quirk)
porneL
You can handle this kind of path in IIS by using either a custom .Net HttpModule or maybe the UrlRewrite option in IIS7.
David
A: 

What if I don't want to force the SaveAs dialog, but if a user right-clicks on a link and chooses to save the document to disk I want to suggest the file name, can this be done?

Yep, just define the "filename" portion and leave out the "attachment" part. That seems to work in my testing. Don't forget to quote the actual filename part to protect against spaces.
Yadyn
A: 

Hi, in asp.net mvc2 i use something like this:

return File(
    tempFile
    , "application/octet-stream"
    , HttpUtility.UrlPathEncode(fileName)
    );

I guess if you don't use mvc(2) you could just encode the filename using

HttpUtility.UrlPathEncode(fileName)

greets, Elmer

Elmer