Uses of content-disposition in an HTTP response header

Question

I have found the following asp.net code to be very useful when serving files from a database:

Response.AppendHeader("content-disposition", "attachment; filename=" + fileName);

This lets the user save the file to their computer and then decide how to use it, instead of the browser trying to use the file.

What other things can be done with the content-disposition response header?

Note that your sample code will break if filename contains whitespace or non-ASCII characters. See RFC 6266 for more information. — Julian Reschke, Sep 02 '11 at 14:58
@JulianReschke, What about ASCII characters that are considered non-printable? (`0` to `0x1F`) — Pacerier, Feb 05 '15 at 09:39
Read RFC 6266 (apart the fact they would be a bad idea to use in a filename; recipients are likely to throw them away anyway) — Julian Reschke, Feb 05 '15 at 10:13
You can use white space, Unicode etc.. if you use double quotes around the name. http://kb.mozillazine.org/Filenames_with_spaces_are_truncated_upon_download — Tony BenBrahim, Mar 29 '16 at 15:18

score 87 · Accepted Answer · edited Oct 07 '21 at 05:46

87

Note that RFC 6266 supersedes the RFCs referenced below. Section 7 outlines some of the related security concerns.

The authority on the content-disposition header is RFC 1806 and RFC 2183. People have also devised content-disposition hacking. It is important to note that the content-disposition header is not part of the HTTP 1.1 standard.

The HTTP 1.1 Standard (RFC 2616) also mentions the possible security side effects of content disposition:

15.5 Content-Disposition Issues

RFC 1806 [35], from which the often implemented Content-Disposition
(see section 19.5.1) header in HTTP is derived, has a number of very
serious security considerations. Content-Disposition is not part of
the HTTP standard, but since it is widely implemented, we are
documenting its use and risks for implementors. See RFC 2183 [49]
(which updates RFC 1806) for details.

edited Oct 07 '21 at 05:46

Community

1
1

answered Jun 18 '09 at 12:49

Andrew

1,853
1
14
15

31

Nowadays, the authority is RFC 6266. – Julian Reschke Sep 02 '11 at 14:57
@JulianReschke, How does "supersedes" and "updates" work? Does newer versions like RFC 7230 also renders RFC 6266 as obsolete? – Pacerier Dec 10 '14 at 12:17
@Pacerier -- why would RFC 7230 affect RFC 6266? – Julian Reschke Dec 10 '14 at 13:40
@Julian, *1)* Since 6266 updates 2616, *2)* 2616 has been made obsolete by 723X, *3)* Then, is 6266 also considered obsoleted? – Pacerier Feb 05 '15 at 09:58
If 723X had made 6266 obsolete, then it would make 6216 obsolete. – vol7ron Oct 08 '15 at 15:39
6

Well, RFC 5678 here, RFC 9876 there. If Content-Disposition is frowned upon, what should we use instead? – Csaba Toth Mar 20 '16 at 18:46

score 26 · Answer 2 · edited May 01 '17 at 02:07

26

Well, it seems that the Content-Disposition header was originally created for e-mail, not the web. (Link to relevant RFC.)

I'm guessing that web browsers may respond to

Response.AppendHeader("content-disposition", "inline; filename=" + fileName);

when saving, but I'm not sure.

edited May 01 '17 at 02:07

answered Jun 18 '09 at 12:45

MiffTheFox

21,302
14
69
94

score 6 · Answer 3 · edited Oct 07 '21 at 05:54

6

Refer to RFC 6266 (Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)) https://www.rfc-editor.org/rfc/rfc6266

edited Oct 07 '21 at 05:54

Community

1
1

answered Mar 01 '13 at 05:14

Manish Pai

69
1
1

score 6 · Answer 4 · edited Apr 30 '17 at 16:08

6

For asp.net users, the .NET framework provides a class to create a content disposition header: System.Net.Mime.ContentDisposition

Basic usage:

var cd = new System.Net.Mime.ContentDisposition();
cd.FileName = "myFile.txt";
cd.ModificationDate = DateTime.UtcNow;
cd.Size = 100;
Response.AppendHeader("content-disposition", cd.ToString());

edited Apr 30 '17 at 16:08

answered Mar 06 '14 at 10:10

onof

17,167
7
49
85

1

Beware, this class does not conform to [RFC 6266](http://tools.ietf.org/html/rfc6266#section-4.3). It does UTF-8 base64 encoding in `filename` parameter, instead of using `filename*` parameter with [RFC 5987](http://tools.ietf.org/html/rfc5987) encoding. No way to derive or use fx utils to fix that, almost everything is non-overridable or internal... .Net fx has still a long way learning openness and extensibility. In MVC 5.2, `FileResult` class does a little better for `filename`, but does not handles others parameters as `inline` and most of its implementation is also internal... – Frédéric Jan 19 '16 at 09:39

score 2 · Answer 5 · answered Jun 18 '09 at 12:50

2

This header is defined in RFC 2183, so that would be the best place to start reading.

Permitted values are those registered with the Internet Assigned Numbers Authority (IANA); their registry of values should be seen as the definitive source.

answered Jun 18 '09 at 12:50

NickFitz

34,537
8
43
40

Uses of content-disposition in an HTTP response header

5 Answers5

Linked

Related