| 1 | <!DOCTYPE html |
|---|
| 2 | PUBLIC "-//W3C//DTD HTML 4.01//EN"> |
|---|
| 3 | <html lang="en"> |
|---|
| 4 | <head profile="http://www.w3.org/2006/03/hcard http://dublincore.org/documents/2008/08/04/dc-html/"> |
|---|
| 5 | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> |
|---|
| 6 | <title>Use of the Content-Disposition Header Field |
|---|
| 7 | in the Hypertext Transfer Protocol (HTTP) |
|---|
| 8 | </title><style type="text/css" title="Xml2Rfc (sans serif)"> |
|---|
| 9 | a { |
|---|
| 10 | text-decoration: none; |
|---|
| 11 | } |
|---|
| 12 | a.smpl { |
|---|
| 13 | color: black; |
|---|
| 14 | } |
|---|
| 15 | a:hover { |
|---|
| 16 | text-decoration: underline; |
|---|
| 17 | } |
|---|
| 18 | a:active { |
|---|
| 19 | text-decoration: underline; |
|---|
| 20 | } |
|---|
| 21 | address { |
|---|
| 22 | margin-top: 1em; |
|---|
| 23 | margin-left: 2em; |
|---|
| 24 | font-style: normal; |
|---|
| 25 | } |
|---|
| 26 | blockquote { |
|---|
| 27 | border-style: solid; |
|---|
| 28 | border-color: gray; |
|---|
| 29 | border-width: 0 0 0 .25em; |
|---|
| 30 | font-style: italic; |
|---|
| 31 | padding-left: 0.5em; |
|---|
| 32 | } |
|---|
| 33 | body { |
|---|
| 34 | color: black; |
|---|
| 35 | font-family: verdana, helvetica, arial, sans-serif; |
|---|
| 36 | font-size: 10pt; |
|---|
| 37 | } |
|---|
| 38 | cite { |
|---|
| 39 | font-style: normal; |
|---|
| 40 | } |
|---|
| 41 | div.note { |
|---|
| 42 | margin-left: 2em; |
|---|
| 43 | } |
|---|
| 44 | dd { |
|---|
| 45 | margin-right: 2em; |
|---|
| 46 | } |
|---|
| 47 | dl { |
|---|
| 48 | margin-left: 2em; |
|---|
| 49 | } |
|---|
| 50 | |
|---|
| 51 | ul.empty { |
|---|
| 52 | list-style-type: none; |
|---|
| 53 | } |
|---|
| 54 | ul.empty li { |
|---|
| 55 | margin-top: .5em; |
|---|
| 56 | } |
|---|
| 57 | dl p { |
|---|
| 58 | margin-left: 0em; |
|---|
| 59 | } |
|---|
| 60 | dt { |
|---|
| 61 | margin-top: .5em; |
|---|
| 62 | } |
|---|
| 63 | h1 { |
|---|
| 64 | font-size: 14pt; |
|---|
| 65 | line-height: 21pt; |
|---|
| 66 | page-break-after: avoid; |
|---|
| 67 | } |
|---|
| 68 | h1.np { |
|---|
| 69 | page-break-before: always; |
|---|
| 70 | } |
|---|
| 71 | h1 a { |
|---|
| 72 | color: #333333; |
|---|
| 73 | } |
|---|
| 74 | h2 { |
|---|
| 75 | font-size: 12pt; |
|---|
| 76 | line-height: 15pt; |
|---|
| 77 | page-break-after: avoid; |
|---|
| 78 | } |
|---|
| 79 | h3, h4, h5, h6 { |
|---|
| 80 | font-size: 10pt; |
|---|
| 81 | page-break-after: avoid; |
|---|
| 82 | } |
|---|
| 83 | h2 a, h3 a, h4 a, h5 a, h6 a { |
|---|
| 84 | color: black; |
|---|
| 85 | } |
|---|
| 86 | img { |
|---|
| 87 | margin-left: 3em; |
|---|
| 88 | } |
|---|
| 89 | li { |
|---|
| 90 | margin-left: 2em; |
|---|
| 91 | margin-right: 2em; |
|---|
| 92 | } |
|---|
| 93 | ol { |
|---|
| 94 | margin-left: 2em; |
|---|
| 95 | margin-right: 2em; |
|---|
| 96 | } |
|---|
| 97 | ol.la { |
|---|
| 98 | list-style-type: lower-alpha; |
|---|
| 99 | } |
|---|
| 100 | ol.ua { |
|---|
| 101 | list-style-type: upper-alpha; |
|---|
| 102 | } |
|---|
| 103 | ol p { |
|---|
| 104 | margin-left: 0em; |
|---|
| 105 | } |
|---|
| 106 | p { |
|---|
| 107 | margin-left: 2em; |
|---|
| 108 | margin-right: 2em; |
|---|
| 109 | } |
|---|
| 110 | pre { |
|---|
| 111 | margin-left: 3em; |
|---|
| 112 | background-color: lightyellow; |
|---|
| 113 | padding: .25em; |
|---|
| 114 | } |
|---|
| 115 | pre.text2 { |
|---|
| 116 | border-style: dotted; |
|---|
| 117 | border-width: 1px; |
|---|
| 118 | background-color: #f0f0f0; |
|---|
| 119 | width: 69em; |
|---|
| 120 | } |
|---|
| 121 | pre.inline { |
|---|
| 122 | background-color: white; |
|---|
| 123 | padding: 0em; |
|---|
| 124 | } |
|---|
| 125 | pre.text { |
|---|
| 126 | border-style: dotted; |
|---|
| 127 | border-width: 1px; |
|---|
| 128 | background-color: #f8f8f8; |
|---|
| 129 | width: 69em; |
|---|
| 130 | } |
|---|
| 131 | pre.drawing { |
|---|
| 132 | border-style: solid; |
|---|
| 133 | border-width: 1px; |
|---|
| 134 | background-color: #f8f8f8; |
|---|
| 135 | padding: 2em; |
|---|
| 136 | } |
|---|
| 137 | table { |
|---|
| 138 | margin-left: 2em; |
|---|
| 139 | } |
|---|
| 140 | table.tt { |
|---|
| 141 | vertical-align: top; |
|---|
| 142 | } |
|---|
| 143 | table.full { |
|---|
| 144 | border-style: outset; |
|---|
| 145 | border-width: 1px; |
|---|
| 146 | } |
|---|
| 147 | table.headers { |
|---|
| 148 | border-style: outset; |
|---|
| 149 | border-width: 1px; |
|---|
| 150 | } |
|---|
| 151 | table.tt td { |
|---|
| 152 | vertical-align: top; |
|---|
| 153 | } |
|---|
| 154 | table.full td { |
|---|
| 155 | border-style: inset; |
|---|
| 156 | border-width: 1px; |
|---|
| 157 | } |
|---|
| 158 | table.tt th { |
|---|
| 159 | vertical-align: top; |
|---|
| 160 | } |
|---|
| 161 | table.full th { |
|---|
| 162 | border-style: inset; |
|---|
| 163 | border-width: 1px; |
|---|
| 164 | } |
|---|
| 165 | table.headers th { |
|---|
| 166 | border-style: none none inset none; |
|---|
| 167 | border-width: 1px; |
|---|
| 168 | } |
|---|
| 169 | table.left { |
|---|
| 170 | margin-right: auto; |
|---|
| 171 | } |
|---|
| 172 | table.right { |
|---|
| 173 | margin-left: auto; |
|---|
| 174 | } |
|---|
| 175 | table.center { |
|---|
| 176 | margin-left: auto; |
|---|
| 177 | margin-right: auto; |
|---|
| 178 | } |
|---|
| 179 | caption { |
|---|
| 180 | caption-side: bottom; |
|---|
| 181 | font-weight: bold; |
|---|
| 182 | font-size: 9pt; |
|---|
| 183 | margin-top: .5em; |
|---|
| 184 | } |
|---|
| 185 | |
|---|
| 186 | table.header { |
|---|
| 187 | border-spacing: 1px; |
|---|
| 188 | width: 95%; |
|---|
| 189 | font-size: 10pt; |
|---|
| 190 | color: white; |
|---|
| 191 | } |
|---|
| 192 | td.top { |
|---|
| 193 | vertical-align: top; |
|---|
| 194 | } |
|---|
| 195 | td.topnowrap { |
|---|
| 196 | vertical-align: top; |
|---|
| 197 | white-space: nowrap; |
|---|
| 198 | } |
|---|
| 199 | table.header td { |
|---|
| 200 | background-color: gray; |
|---|
| 201 | width: 50%; |
|---|
| 202 | } |
|---|
| 203 | table.header a { |
|---|
| 204 | color: white; |
|---|
| 205 | } |
|---|
| 206 | td.reference { |
|---|
| 207 | vertical-align: top; |
|---|
| 208 | white-space: nowrap; |
|---|
| 209 | padding-right: 1em; |
|---|
| 210 | } |
|---|
| 211 | thead { |
|---|
| 212 | display:table-header-group; |
|---|
| 213 | } |
|---|
| 214 | ul.toc, ul.toc ul { |
|---|
| 215 | list-style: none; |
|---|
| 216 | margin-left: 1.5em; |
|---|
| 217 | margin-right: 0em; |
|---|
| 218 | padding-left: 0em; |
|---|
| 219 | } |
|---|
| 220 | ul.toc li { |
|---|
| 221 | line-height: 150%; |
|---|
| 222 | font-weight: bold; |
|---|
| 223 | font-size: 10pt; |
|---|
| 224 | margin-left: 0em; |
|---|
| 225 | margin-right: 0em; |
|---|
| 226 | } |
|---|
| 227 | ul.toc li li { |
|---|
| 228 | line-height: normal; |
|---|
| 229 | font-weight: normal; |
|---|
| 230 | font-size: 9pt; |
|---|
| 231 | margin-left: 0em; |
|---|
| 232 | margin-right: 0em; |
|---|
| 233 | } |
|---|
| 234 | li.excluded { |
|---|
| 235 | font-size: 0pt; |
|---|
| 236 | } |
|---|
| 237 | ul p { |
|---|
| 238 | margin-left: 0em; |
|---|
| 239 | } |
|---|
| 240 | ul.ind, ul.ind ul { |
|---|
| 241 | list-style: none; |
|---|
| 242 | margin-left: 1.5em; |
|---|
| 243 | margin-right: 0em; |
|---|
| 244 | padding-left: 0em; |
|---|
| 245 | page-break-before: avoid; |
|---|
| 246 | } |
|---|
| 247 | ul.ind li { |
|---|
| 248 | font-weight: bold; |
|---|
| 249 | line-height: 200%; |
|---|
| 250 | margin-left: 0em; |
|---|
| 251 | margin-right: 0em; |
|---|
| 252 | } |
|---|
| 253 | ul.ind li li { |
|---|
| 254 | font-weight: normal; |
|---|
| 255 | line-height: 150%; |
|---|
| 256 | margin-left: 0em; |
|---|
| 257 | margin-right: 0em; |
|---|
| 258 | } |
|---|
| 259 | .avoidbreak { |
|---|
| 260 | page-break-inside: avoid; |
|---|
| 261 | } |
|---|
| 262 | .bcp14 { |
|---|
| 263 | font-style: normal; |
|---|
| 264 | text-transform: lowercase; |
|---|
| 265 | font-variant: small-caps; |
|---|
| 266 | } |
|---|
| 267 | blockquote > * .bcp14 { |
|---|
| 268 | font-style: italic; |
|---|
| 269 | } |
|---|
| 270 | .comment { |
|---|
| 271 | background-color: yellow; |
|---|
| 272 | } |
|---|
| 273 | .center { |
|---|
| 274 | text-align: center; |
|---|
| 275 | } |
|---|
| 276 | .error { |
|---|
| 277 | color: red; |
|---|
| 278 | font-style: italic; |
|---|
| 279 | font-weight: bold; |
|---|
| 280 | } |
|---|
| 281 | .figure { |
|---|
| 282 | font-weight: bold; |
|---|
| 283 | text-align: center; |
|---|
| 284 | font-size: 9pt; |
|---|
| 285 | } |
|---|
| 286 | .filename { |
|---|
| 287 | color: #333333; |
|---|
| 288 | font-weight: bold; |
|---|
| 289 | font-size: 12pt; |
|---|
| 290 | line-height: 21pt; |
|---|
| 291 | text-align: center; |
|---|
| 292 | } |
|---|
| 293 | .fn { |
|---|
| 294 | font-weight: bold; |
|---|
| 295 | } |
|---|
| 296 | .hidden { |
|---|
| 297 | display: none; |
|---|
| 298 | } |
|---|
| 299 | .left { |
|---|
| 300 | text-align: left; |
|---|
| 301 | } |
|---|
| 302 | .right { |
|---|
| 303 | text-align: right; |
|---|
| 304 | } |
|---|
| 305 | .title { |
|---|
| 306 | color: #990000; |
|---|
| 307 | font-size: 18pt; |
|---|
| 308 | line-height: 18pt; |
|---|
| 309 | font-weight: bold; |
|---|
| 310 | text-align: center; |
|---|
| 311 | margin-top: 36pt; |
|---|
| 312 | } |
|---|
| 313 | .vcardline { |
|---|
| 314 | display: block; |
|---|
| 315 | } |
|---|
| 316 | .warning { |
|---|
| 317 | font-size: 14pt; |
|---|
| 318 | background-color: yellow; |
|---|
| 319 | } |
|---|
| 320 | |
|---|
| 321 | |
|---|
| 322 | @media print { |
|---|
| 323 | .noprint { |
|---|
| 324 | display: none; |
|---|
| 325 | } |
|---|
| 326 | |
|---|
| 327 | a { |
|---|
| 328 | color: black; |
|---|
| 329 | text-decoration: none; |
|---|
| 330 | } |
|---|
| 331 | |
|---|
| 332 | table.header { |
|---|
| 333 | width: 90%; |
|---|
| 334 | } |
|---|
| 335 | |
|---|
| 336 | td.header { |
|---|
| 337 | width: 50%; |
|---|
| 338 | color: black; |
|---|
| 339 | background-color: white; |
|---|
| 340 | vertical-align: top; |
|---|
| 341 | font-size: 12pt; |
|---|
| 342 | } |
|---|
| 343 | |
|---|
| 344 | ul.toc a::after { |
|---|
| 345 | content: leader('.') target-counter(attr(href), page); |
|---|
| 346 | } |
|---|
| 347 | |
|---|
| 348 | ul.ind li li a { |
|---|
| 349 | content: target-counter(attr(href), page); |
|---|
| 350 | } |
|---|
| 351 | |
|---|
| 352 | .print2col { |
|---|
| 353 | column-count: 2; |
|---|
| 354 | -moz-column-count: 2; |
|---|
| 355 | column-fill: auto; |
|---|
| 356 | } |
|---|
| 357 | } |
|---|
| 358 | |
|---|
| 359 | @page { |
|---|
| 360 | @top-left { |
|---|
| 361 | content: "Internet-Draft"; |
|---|
| 362 | } |
|---|
| 363 | @top-right { |
|---|
| 364 | content: "March 2011"; |
|---|
| 365 | } |
|---|
| 366 | @top-center { |
|---|
| 367 | content: "Content-Disposition in HTTP"; |
|---|
| 368 | } |
|---|
| 369 | @bottom-left { |
|---|
| 370 | content: "Reschke"; |
|---|
| 371 | } |
|---|
| 372 | @bottom-center { |
|---|
| 373 | content: "Expires September 15, 2011"; |
|---|
| 374 | } |
|---|
| 375 | @bottom-right { |
|---|
| 376 | content: "[Page " counter(page) "]"; |
|---|
| 377 | } |
|---|
| 378 | } |
|---|
| 379 | |
|---|
| 380 | @page:first { |
|---|
| 381 | @top-left { |
|---|
| 382 | content: normal; |
|---|
| 383 | } |
|---|
| 384 | @top-right { |
|---|
| 385 | content: normal; |
|---|
| 386 | } |
|---|
| 387 | @top-center { |
|---|
| 388 | content: normal; |
|---|
| 389 | } |
|---|
| 390 | } |
|---|
| 391 | </style><link rel="Contents" href="#rfc.toc"> |
|---|
| 392 | <link rel="Author" href="#rfc.authors"> |
|---|
| 393 | <link rel="Copyright" href="#rfc.copyrightnotice"> |
|---|
| 394 | <link rel="Index" href="#rfc.index"> |
|---|
| 395 | <link rel="Chapter" title="1 Introduction" href="#rfc.section.1"> |
|---|
| 396 | <link rel="Chapter" title="2 Notational Conventions" href="#rfc.section.2"> |
|---|
| 397 | <link rel="Chapter" title="3 Conformance and Error Handling" href="#rfc.section.3"> |
|---|
| 398 | <link rel="Chapter" title="4 Header Field Definition" href="#rfc.section.4"> |
|---|
| 399 | <link rel="Chapter" title="5 Examples" href="#rfc.section.5"> |
|---|
| 400 | <link rel="Chapter" title="6 Internationalization Considerations" href="#rfc.section.6"> |
|---|
| 401 | <link rel="Chapter" title="7 Security Considerations" href="#rfc.section.7"> |
|---|
| 402 | <link rel="Chapter" title="8 IANA Considerations" href="#rfc.section.8"> |
|---|
| 403 | <link rel="Chapter" title="9 Acknowledgements" href="#rfc.section.9"> |
|---|
| 404 | <link rel="Chapter" href="#rfc.section.10" title="10 References"> |
|---|
| 405 | <link rel="Appendix" title="A Changes from the RFC 2616 Definition" href="#rfc.section.A"> |
|---|
| 406 | <link rel="Appendix" title="B Differences compared to RFC 2183" href="#rfc.section.B"> |
|---|
| 407 | <link rel="Appendix" title="C Alternative Approaches to Internationalization" href="#rfc.section.C"> |
|---|
| 408 | <link rel="Appendix" title="D Advice on Generating Content-Disposition Header Fields" href="#rfc.section.D"> |
|---|
| 409 | <link rel="Appendix" title="E Change Log (to be removed by RFC Editor before publication)" href="#rfc.section.E"> |
|---|
| 410 | <meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1.543, 2011-02-18 21:03:40, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/"> |
|---|
| 411 | <link rel="schema.dct" href="http://purl.org/dc/terms/"> |
|---|
| 412 | <meta name="dct.creator" content="Reschke, J. F."> |
|---|
| 413 | <meta name="dct.identifier" content="urn:ietf:id:draft-ietf-httpbis-content-disp-07"> |
|---|
| 414 | <meta name="dct.issued" scheme="ISO8601" content="2011-03-14"> |
|---|
| 415 | <meta name="dct.abstract" content="RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization aspects."> |
|---|
| 416 | <meta name="description" content="RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization aspects."> |
|---|
| 417 | </head> |
|---|
| 418 | <body> |
|---|
| 419 | <table class="header"> |
|---|
| 420 | <tbody> |
|---|
| 421 | <tr> |
|---|
| 422 | <td class="left">HTTPbis Working Group</td> |
|---|
| 423 | <td class="right">J. Reschke</td> |
|---|
| 424 | </tr> |
|---|
| 425 | <tr> |
|---|
| 426 | <td class="left">Internet-Draft</td> |
|---|
| 427 | <td class="right">greenbytes</td> |
|---|
| 428 | </tr> |
|---|
| 429 | <tr> |
|---|
| 430 | <td class="left">Updates: <a href="http://tools.ietf.org/html/rfc2616">2616</a> (if approved) |
|---|
| 431 | </td> |
|---|
| 432 | <td class="right">March 14, 2011</td> |
|---|
| 433 | </tr> |
|---|
| 434 | <tr> |
|---|
| 435 | <td class="left">Intended status: Standards Track</td> |
|---|
| 436 | <td class="right"></td> |
|---|
| 437 | </tr> |
|---|
| 438 | <tr> |
|---|
| 439 | <td class="left">Expires: September 15, 2011</td> |
|---|
| 440 | <td class="right"></td> |
|---|
| 441 | </tr> |
|---|
| 442 | </tbody> |
|---|
| 443 | </table> |
|---|
| 444 | <p class="title">Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)<br><span class="filename">draft-ietf-httpbis-content-disp-07</span></p> |
|---|
| 445 | <h1 id="rfc.abstract"><a href="#rfc.abstract">Abstract</a></h1> |
|---|
| 446 | <p>RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. |
|---|
| 447 | This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization |
|---|
| 448 | aspects. |
|---|
| 449 | </p> |
|---|
| 450 | <h1 id="rfc.note.1"><a href="#rfc.note.1">Editorial Note (To be removed by RFC Editor before publication)</a></h1> |
|---|
| 451 | <p>This specification is expected to replace the definition of Content-Disposition in the HTTP/1.1 specification, as currently |
|---|
| 452 | revised by the IETF HTTPbis working group. See also <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/ticket/123">http://trac.tools.ietf.org/wg/httpbis/trac/ticket/123</a>>. |
|---|
| 453 | </p> |
|---|
| 454 | <p>Discussion of this draft should take place on the HTTPBIS working group mailing list (ietf-http-wg@w3.org). The current issues |
|---|
| 455 | list is at <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/query?component=content-disp">http://trac.tools.ietf.org/wg/httpbis/trac/query?component=content-disp</a>> and related documents (including fancy diffs) can be found at <<a href="http://tools.ietf.org/wg/httpbis/">http://tools.ietf.org/wg/httpbis/</a>>. |
|---|
| 456 | </p> |
|---|
| 457 | <p>The changes in this draft are summarized in <a href="#changes.since.06" title="Since draft-ietf-httpbis-content-disp-06">Appendix E.11</a>. |
|---|
| 458 | </p> |
|---|
| 459 | <h1><a id="rfc.status" href="#rfc.status">Status of This Memo</a></h1> |
|---|
| 460 | <p>This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.</p> |
|---|
| 461 | <p>Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute |
|---|
| 462 | working documents as Internet-Drafts. The list of current Internet-Drafts is at <a href="http://datatracker.ietf.org/drafts/current/">http://datatracker.ietf.org/drafts/current/</a>. |
|---|
| 463 | </p> |
|---|
| 464 | <p>Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other |
|---|
| 465 | documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work |
|---|
| 466 | in progress”. |
|---|
| 467 | </p> |
|---|
| 468 | <p>This Internet-Draft will expire on September 15, 2011.</p> |
|---|
| 469 | <h1><a id="rfc.copyrightnotice" href="#rfc.copyrightnotice">Copyright Notice</a></h1> |
|---|
| 470 | <p>Copyright © 2011 IETF Trust and the persons identified as the document authors. All rights reserved.</p> |
|---|
| 471 | <p>This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights |
|---|
| 472 | and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License |
|---|
| 473 | text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified |
|---|
| 474 | BSD License. |
|---|
| 475 | </p> |
|---|
| 476 | <hr class="noprint"> |
|---|
| 477 | <h1 class="np" id="rfc.toc"><a href="#rfc.toc">Table of Contents</a></h1> |
|---|
| 478 | <ul class="toc"> |
|---|
| 479 | <li>1. <a href="#introduction">Introduction</a></li> |
|---|
| 480 | <li>2. <a href="#notational.conventions">Notational Conventions</a></li> |
|---|
| 481 | <li>3. <a href="#conformance.and.error.handling">Conformance and Error Handling</a></li> |
|---|
| 482 | <li>4. <a href="#header.field.definition">Header Field Definition</a><ul> |
|---|
| 483 | <li>4.1 <a href="#rfc.section.4.1">Grammar</a></li> |
|---|
| 484 | <li>4.2 <a href="#disposition.type">Disposition Type</a></li> |
|---|
| 485 | <li>4.3 <a href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></li> |
|---|
| 486 | <li>4.4 <a href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></li> |
|---|
| 487 | <li>4.5 <a href="#extensibility">Extensibility</a></li> |
|---|
| 488 | </ul> |
|---|
| 489 | </li> |
|---|
| 490 | <li>5. <a href="#examples">Examples</a></li> |
|---|
| 491 | <li>6. <a href="#i18n">Internationalization Considerations</a></li> |
|---|
| 492 | <li>7. <a href="#security.considerations">Security Considerations</a></li> |
|---|
| 493 | <li>8. <a href="#iana.considerations">IANA Considerations</a><ul> |
|---|
| 494 | <li>8.1 <a href="#registry">Registry for Disposition Values and Parameter</a></li> |
|---|
| 495 | <li>8.2 <a href="#header.field.registration">Header Field Registration</a></li> |
|---|
| 496 | </ul> |
|---|
| 497 | </li> |
|---|
| 498 | <li>9. <a href="#rfc.section.9">Acknowledgements</a></li> |
|---|
| 499 | <li>10. <a href="#rfc.references">References</a><ul> |
|---|
| 500 | <li>10.1 <a href="#rfc.references.1">Normative References</a></li> |
|---|
| 501 | <li>10.2 <a href="#rfc.references.2">Informative References</a></li> |
|---|
| 502 | </ul> |
|---|
| 503 | </li> |
|---|
| 504 | <li><a href="#rfc.authors">Author's Address</a></li> |
|---|
| 505 | <li>A. <a href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></li> |
|---|
| 506 | <li>B. <a href="#diffs.compared.to.rfc2183">Differences compared to RFC 2183</a></li> |
|---|
| 507 | <li>C. <a href="#alternatives">Alternative Approaches to Internationalization</a><ul> |
|---|
| 508 | <li>C.1 <a href="#alternatives.rfc2047">RFC 2047 Encoding</a></li> |
|---|
| 509 | <li>C.2 <a href="#alternatives.percent">Percent Encoding</a></li> |
|---|
| 510 | <li>C.3 <a href="#alternatives.sniff">Encoding Sniffing</a></li> |
|---|
| 511 | <li>C.4 <a href="#alternatives.implementations">Implementations (to be removed by RFC Editor before publication)</a></li> |
|---|
| 512 | </ul> |
|---|
| 513 | </li> |
|---|
| 514 | <li>D. <a href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></li> |
|---|
| 515 | <li>E. <a href="#change.log">Change Log (to be removed by RFC Editor before publication)</a><ul> |
|---|
| 516 | <li>E.1 <a href="#rfc.section.E.1">Since draft-reschke-rfc2183-in-http-00</a></li> |
|---|
| 517 | <li>E.2 <a href="#rfc.section.E.2">Since draft-reschke-rfc2183-in-http-01</a></li> |
|---|
| 518 | <li>E.3 <a href="#rfc.section.E.3">Since draft-reschke-rfc2183-in-http-02</a></li> |
|---|
| 519 | <li>E.4 <a href="#rfc.section.E.4">Since draft-reschke-rfc2183-in-http-03</a></li> |
|---|
| 520 | <li>E.5 <a href="#changes.since.00">Since draft-ietf-httpbis-content-disp-00</a></li> |
|---|
| 521 | <li>E.6 <a href="#changes.since.01">Since draft-ietf-httpbis-content-disp-01</a></li> |
|---|
| 522 | <li>E.7 <a href="#changes.since.02">Since draft-ietf-httpbis-content-disp-02</a></li> |
|---|
| 523 | <li>E.8 <a href="#changes.since.03">Since draft-ietf-httpbis-content-disp-03</a></li> |
|---|
| 524 | <li>E.9 <a href="#changes.since.04">Since draft-ietf-httpbis-content-disp-04</a></li> |
|---|
| 525 | <li>E.10 <a href="#changes.since.05">Since draft-ietf-httpbis-content-disp-05</a></li> |
|---|
| 526 | <li>E.11 <a href="#changes.since.06">Since draft-ietf-httpbis-content-disp-06</a></li> |
|---|
| 527 | </ul> |
|---|
| 528 | </li> |
|---|
| 529 | <li><a href="#rfc.index">Index</a></li> |
|---|
| 530 | </ul> |
|---|
| 531 | <h1 id="rfc.section.1" class="np"><a href="#rfc.section.1">1.</a> <a id="introduction" href="#introduction">Introduction</a></h1> |
|---|
| 532 | <p id="rfc.section.1.p.1">RFC 2616 defines the Content-Disposition response header field in <a href="http://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.1"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, but points out that it is not part of the HTTP/1.1 Standard (<a href="http://tools.ietf.org/html/rfc2616#section-15.5" id="rfc.xref.RFC2616.2">Section 15.5</a>): |
|---|
| 533 | </p> |
|---|
| 534 | <blockquote id="rfc.section.1.p.2" cite="http://tools.ietf.org/html/rfc2616#section-15.5"> |
|---|
| 535 | <p>Content-Disposition is not part of the HTTP standard, but since it is widely implemented, we are documenting its use and risks |
|---|
| 536 | for implementers. |
|---|
| 537 | </p> |
|---|
| 538 | </blockquote> |
|---|
| 539 | <p id="rfc.section.1.p.3">This specification takes over the definition and registration of Content-Disposition, as used in HTTP. Based on interoperability |
|---|
| 540 | testing with existing User Agents, it fully defines a profile of the features defined in the Multipurpose Internet Mail Extensions |
|---|
| 541 | (MIME) variant (<a href="#RFC2183" id="rfc.xref.RFC2183.1"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>) of the header field, and also clarifies internationalization aspects. |
|---|
| 542 | </p> |
|---|
| 543 | <div class="note" id="rfc.section.1.p.4"> |
|---|
| 544 | <p> <b>Note:</b> this document does not apply to Content-Disposition header fields appearing in payload bodies transmitted over HTTP, such |
|---|
| 545 | as when using the media type "multipart/form-data" (<a href="#RFC2388" id="rfc.xref.RFC2388.1"><cite title="Returning Values from Forms: multipart/form-data">[RFC2388]</cite></a>). |
|---|
| 546 | </p> |
|---|
| 547 | </div> |
|---|
| 548 | <h1 id="rfc.section.2"><a href="#rfc.section.2">2.</a> <a id="notational.conventions" href="#notational.conventions">Notational Conventions</a></h1> |
|---|
| 549 | <p id="rfc.section.2.p.1">The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" |
|---|
| 550 | in this document are to be interpreted as described in <a href="#RFC2119" id="rfc.xref.RFC2119.1"><cite title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</cite></a>. |
|---|
| 551 | </p> |
|---|
| 552 | <p id="rfc.section.2.p.2">This specification uses the augmented BNF notation defined in <a href="http://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.3"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, including its rules for implied linear whitespace (LWS). |
|---|
| 553 | </p> |
|---|
| 554 | <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> <a id="conformance.and.error.handling" href="#conformance.and.error.handling">Conformance and Error Handling</a></h1> |
|---|
| 555 | <p id="rfc.section.3.p.1">This specification defines conformance criteria for both senders (usually, HTTP origin servers) and recipients (usually, HTTP |
|---|
| 556 | user agents) of the Content-Disposition header field. An implementation is considered conformant if it complies with all of |
|---|
| 557 | the requirements associated with its role. |
|---|
| 558 | </p> |
|---|
| 559 | <p id="rfc.section.3.p.2">This specification also defines certain forms of the header field-value to be invalid, using both ABNF and prose requirements, |
|---|
| 560 | but it does not define special handling of these invalid field-values. |
|---|
| 561 | </p> |
|---|
| 562 | <p id="rfc.section.3.p.3">Senders <em class="bcp14">MUST NOT</em> generate Content-Disposition header fields that are invalid. |
|---|
| 563 | </p> |
|---|
| 564 | <p id="rfc.section.3.p.4">Recipients <em class="bcp14">MAY</em> take steps to recover a usable field-value from an invalid header field, but <em class="bcp14">SHOULD NOT</em> reject the message outright, unless this is explicitly desirable behaviour (e.g., the implementation is a validator). As such, |
|---|
| 565 | the default handling of invalid fields is to ignore them. |
|---|
| 566 | </p> |
|---|
| 567 | <div id="rfc.iref.h.1"></div> |
|---|
| 568 | <div id="rfc.iref.c.1"></div> |
|---|
| 569 | <h1 id="rfc.section.4"><a href="#rfc.section.4">4.</a> <a id="header.field.definition" href="#header.field.definition">Header Field Definition</a></h1> |
|---|
| 570 | <p id="rfc.section.4.p.1">The Content-Disposition response header field is used to convey additional information about how to process the response payload, |
|---|
| 571 | and also can be used to attach additional metadata, such as the filename to use when saving the response payload locally. |
|---|
| 572 | </p> |
|---|
| 573 | <h2 id="rfc.section.4.1"><a href="#rfc.section.4.1">4.1</a> Grammar |
|---|
| 574 | </h2> |
|---|
| 575 | <div id="rfc.figure.u.1"></div><pre class="inline"> content-disposition = "Content-Disposition" ":" |
|---|
| 576 | disposition-type *( ";" disposition-parm ) |
|---|
| 577 | |
|---|
| 578 | disposition-type = "inline" | "attachment" | disp-ext-type |
|---|
| 579 | ; case-insensitive |
|---|
| 580 | disp-ext-type = token |
|---|
| 581 | |
|---|
| 582 | disposition-parm = filename-parm | disp-ext-parm |
|---|
| 583 | |
|---|
| 584 | filename-parm = "filename" "=" value |
|---|
| 585 | | "filename*" "=" ext-value |
|---|
| 586 | |
|---|
| 587 | disp-ext-parm = token "=" value |
|---|
| 588 | | ext-token "=" ext-value |
|---|
| 589 | ext-token = <the characters in token, followed by "*"> |
|---|
| 590 | </pre><div id="rfc.figure.u.2"></div> |
|---|
| 591 | <p>Defined in <a href="#RFC2616" id="rfc.xref.RFC2616.4"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>: |
|---|
| 592 | </p> <pre class="inline"> token = <token, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.5"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>> |
|---|
| 593 | quoted-string = <quoted-string, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.6"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>> |
|---|
| 594 | value = <value, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.7"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-3.6">Section 3.6</a>> |
|---|
| 595 | ; token | quoted-string |
|---|
| 596 | |
|---|
| 597 | </pre><div id="rfc.figure.u.3"></div> |
|---|
| 598 | <p>Defined in <a href="#RFC5987" id="rfc.xref.RFC5987.1"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>: |
|---|
| 599 | </p> <pre class="inline"> ext-value = <ext-value, defined in <a href="#RFC5987" id="rfc.xref.RFC5987.2"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, <a href="http://tools.ietf.org/html/rfc5987#section-3.2">Section 3.2</a>> |
|---|
| 600 | </pre><p id="rfc.section.4.1.p.4">Header field values with multiple instances of the same parameter name are invalid.</p> |
|---|
| 601 | <p id="rfc.section.4.1.p.5">Note that due to the rules for implied linear whitespace (<a href="http://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.8"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), <em class="bcp14">OPTIONAL</em> whitespace can appear between words (token or quoted-string) and separator characters. |
|---|
| 602 | </p> |
|---|
| 603 | <p id="rfc.section.4.1.p.6">Furthermore note that the format used for ext-value allows specifying a natural language; this is of limited use for filenames |
|---|
| 604 | and is likely to be ignored by recipients. |
|---|
| 605 | </p> |
|---|
| 606 | <h2 id="rfc.section.4.2"><a href="#rfc.section.4.2">4.2</a> <a id="disposition.type" href="#disposition.type">Disposition Type</a></h2> |
|---|
| 607 | <p id="rfc.section.4.2.p.1">If the disposition type matches "attachment" (case-insensitively), this indicates that the recipient should prompt the user |
|---|
| 608 | to save the response locally, rather than process it normally (as per its media type). |
|---|
| 609 | </p> |
|---|
| 610 | <p id="rfc.section.4.2.p.2">On the other hand, if it matches "inline" (case-insensitively), this implies default processing. Therefore, the disposition |
|---|
| 611 | type "inline" is only useful when it is augmented with additional parameters, such as the filename (see below). |
|---|
| 612 | </p> |
|---|
| 613 | <p id="rfc.section.4.2.p.3">Unknown or unhandled disposition types <em class="bcp14">SHOULD</em> be handled by recipients the same way as "attachment" (see also <a href="#RFC2183" id="rfc.xref.RFC2183.2"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). |
|---|
| 614 | </p> |
|---|
| 615 | <h2 id="rfc.section.4.3"><a href="#rfc.section.4.3">4.3</a> <a id="disposition.parameter.filename" href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></h2> |
|---|
| 616 | <p id="rfc.section.4.3.p.1">The parameters "filename" and "filename*", to be matched case-insensitively, provide information on how to construct a filename |
|---|
| 617 | for storing the message payload. |
|---|
| 618 | </p> |
|---|
| 619 | <p id="rfc.section.4.3.p.2">Depending on the disposition type, this information might be used right away (in the "save as..." interaction caused for the |
|---|
| 620 | "attachment" disposition type), or later on (for instance, when the user decides to save the contents of the current page |
|---|
| 621 | being displayed). |
|---|
| 622 | </p> |
|---|
| 623 | <p id="rfc.section.4.3.p.3">The parameters "filename" and "filename*" differ only in that "filename*" uses the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.3"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allowing the use of characters not present in the ISO-8859-1 character set (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.1"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>). |
|---|
| 624 | </p> |
|---|
| 625 | <p id="rfc.section.4.3.p.4">Many user agent implementations predating this specification do not understand the "filename*" parameter. Therefore, when |
|---|
| 626 | both "filename" and "filename*" are present in a single header field value, recipients <em class="bcp14">SHOULD</em> pick "filename*" and ignore "filename". This way, senders can avoid special-casing specific user agents by sending both the |
|---|
| 627 | more expressive "filename*" parameter, and the "filename" parameter as fallback for legacy recipients (see <a href="#examples" title="Examples">Section 5</a> for an example). |
|---|
| 628 | </p> |
|---|
| 629 | <p id="rfc.section.4.3.p.5">It is essential that recipients treat the specified filename as advisory only, thus be very careful in extracting the desired |
|---|
| 630 | information. In particular: |
|---|
| 631 | </p> |
|---|
| 632 | <ul> |
|---|
| 633 | <li> |
|---|
| 634 | <p>When the value contains path separator characters ("\" or "/"), recipients <em class="bcp14">SHOULD</em> ignore all but the last path segment. This prevents unintentional overwriting of well-known file system locations (such as |
|---|
| 635 | "/etc/passwd"). |
|---|
| 636 | </p> |
|---|
| 637 | </li> |
|---|
| 638 | <li> |
|---|
| 639 | <p>Many platforms do not use Internet Media Types (<a href="#RFC2046" id="rfc.xref.RFC2046.1"><cite title="Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types">[RFC2046]</cite></a>) to hold type information in the file system, but rely on filename extensions instead. Trusting the server-provided file |
|---|
| 640 | extension could introduce a privilege escalation when the saved file is later opened (consider ".exe"). Thus, recipients <em class="bcp14">SHOULD</em> ensure that a file extension is used that is safe, optimally matching the media type of the received payload. |
|---|
| 641 | </p> |
|---|
| 642 | </li> |
|---|
| 643 | <li> |
|---|
| 644 | <p>Recipients <em class="bcp14">SHOULD</em> strip or replace character sequences that are known to cause confusion both in user interfaces and in filenames, such as control |
|---|
| 645 | characters and leading and trailing whitespace. |
|---|
| 646 | </p> |
|---|
| 647 | </li> |
|---|
| 648 | <li> |
|---|
| 649 | <p>Other aspects recipients need to be aware of are names that have a special meaning in the file system or in shell commands, |
|---|
| 650 | such as "." and "..", "~", "|", and also device names. Recipients <em class="bcp14">SHOULD</em> ignore or substitute names like these. |
|---|
| 651 | </p> |
|---|
| 652 | </li> |
|---|
| 653 | </ul> |
|---|
| 654 | <div class="note" id="rfc.section.4.3.p.6"> |
|---|
| 655 | <p> <b>Note:</b> Many user agents do not properly handle the escape character "\" when using the quoted-string form. Furthermore, some user |
|---|
| 656 | agents erroneously try to perform unescaping of "percent" escapes (see <a href="#alternatives.percent" title="Percent Encoding">Appendix C.2</a>), and thus might misinterpret filenames containing the percent character followed by two hex digits. |
|---|
| 657 | </p> |
|---|
| 658 | </div> |
|---|
| 659 | <h2 id="rfc.section.4.4"><a href="#rfc.section.4.4">4.4</a> <a id="disposition.parameter.extensions" href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></h2> |
|---|
| 660 | <p id="rfc.section.4.4.p.1">To enable future extensions, recipients <em class="bcp14">SHOULD</em> ignore unrecognized parameters (see also <a href="#RFC2183" id="rfc.xref.RFC2183.3"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). |
|---|
| 661 | </p> |
|---|
| 662 | <h2 id="rfc.section.4.5"><a href="#rfc.section.4.5">4.5</a> <a id="extensibility" href="#extensibility">Extensibility</a></h2> |
|---|
| 663 | <p id="rfc.section.4.5.p.1">Note that <a href="http://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.4"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines IANA registries both for disposition types and disposition parameters. This registry is shared by different protocols |
|---|
| 664 | using Content-Disposition, such as MIME and HTTP. Therefore, not all registered values may make sense in the context of HTTP. |
|---|
| 665 | </p> |
|---|
| 666 | <h1 id="rfc.section.5"><a href="#rfc.section.5">5.</a> <a id="examples" href="#examples">Examples</a></h1> |
|---|
| 667 | <div id="rfc.figure.u.4"></div> |
|---|
| 668 | <p>Direct UA to show "save as" dialog, with a filename of "example.html":</p> <pre class="text">Content-Disposition: Attachment; filename=example.html |
|---|
| 669 | </pre><div id="rfc.figure.u.5"></div> |
|---|
| 670 | <p>Direct UA to behave as if the Content-Disposition header field wasn't present, but to remember the filename "an example.html" |
|---|
| 671 | for a subsequent save operation: |
|---|
| 672 | </p> <pre class="text">Content-Disposition: INLINE; FILENAME= "an example.html" |
|---|
| 673 | </pre> <p>Note: this uses the quoted-string form so that the space character can be included.</p> |
|---|
| 674 | <div id="rfc.figure.u.6"></div> |
|---|
| 675 | <p>Direct UA to show "save as" dialog, with a filename containing the Unicode character U+20AC (EURO SIGN):</p> <pre class="text">Content-Disposition: attachment; |
|---|
| 676 | filename*= UTF-8''<b>%e2%82%ac</b>%20rates |
|---|
| 677 | </pre> <p>Here, the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.4"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> is also used to encode the non-ISO-8859-1 character. |
|---|
| 678 | </p> |
|---|
| 679 | <div id="rfc.figure.u.7"></div> |
|---|
| 680 | <p>Same as above, but adding the "filename" parameter for compatibility with user agents not implementing RFC 5987:</p> <pre class="text">Content-Disposition: attachment; |
|---|
| 681 | filename="EURO rates"; |
|---|
| 682 | filename*=utf-8''<b>%e2%82%ac</b>%20rates |
|---|
| 683 | </pre> <p>Note: those user agents that do not support the RFC 5987 encoding ignore "filename*" when it occurs after "filename".</p> |
|---|
| 684 | <h1 id="rfc.section.6"><a href="#rfc.section.6">6.</a> <a id="i18n" href="#i18n">Internationalization Considerations</a></h1> |
|---|
| 685 | <p id="rfc.section.6.p.1">The "filename*" parameter (<a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>), using the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.5"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allows the server to transmit characters outside the ISO-8859-1 character set, and also to optionally specify the language |
|---|
| 686 | in use. |
|---|
| 687 | </p> |
|---|
| 688 | <p id="rfc.section.6.p.2">Future parameters might also require internationalization, in which case the same encoding can be used.</p> |
|---|
| 689 | <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a> <a id="security.considerations" href="#security.considerations">Security Considerations</a></h1> |
|---|
| 690 | <p id="rfc.section.7.p.1">Using server-supplied information for constructing local filenames introduces many risks. These are summarized in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>. |
|---|
| 691 | </p> |
|---|
| 692 | <p id="rfc.section.7.p.2">Furthermore, implementers also ought to be aware of the Security Considerations applying to HTTP (see <a href="http://tools.ietf.org/html/rfc2616#section-15">Section 15</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.9"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), and also the parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.6"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> (see <a href="http://tools.ietf.org/html/rfc5987#section-5" id="rfc.xref.RFC5987.7">Section 5</a>). |
|---|
| 693 | </p> |
|---|
| 694 | <h1 id="rfc.section.8"><a href="#rfc.section.8">8.</a> <a id="iana.considerations" href="#iana.considerations">IANA Considerations</a></h1> |
|---|
| 695 | <h2 id="rfc.section.8.1"><a href="#rfc.section.8.1">8.1</a> <a id="registry" href="#registry">Registry for Disposition Values and Parameter</a></h2> |
|---|
| 696 | <p id="rfc.section.8.1.p.1">This specification does not introduce any changes to the registration procedures for disposition values and parameters that |
|---|
| 697 | are defined in <a href="http://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.5"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>. |
|---|
| 698 | </p> |
|---|
| 699 | <h2 id="rfc.section.8.2"><a href="#rfc.section.8.2">8.2</a> <a id="header.field.registration" href="#header.field.registration">Header Field Registration</a></h2> |
|---|
| 700 | <p id="rfc.section.8.2.p.1">This document updates the definition of the Content-Disposition HTTP header field in the permanent HTTP header field registry |
|---|
| 701 | (see <a href="#RFC3864" id="rfc.xref.RFC3864.1"><cite title="Registration Procedures for Message Header Fields">[RFC3864]</cite></a>). |
|---|
| 702 | </p> |
|---|
| 703 | <p id="rfc.section.8.2.p.2"> </p> |
|---|
| 704 | <dl> |
|---|
| 705 | <dt>Header field name:</dt> |
|---|
| 706 | <dd>Content-Disposition</dd> |
|---|
| 707 | <dt>Applicable protocol:</dt> |
|---|
| 708 | <dd>http</dd> |
|---|
| 709 | <dt>Status:</dt> |
|---|
| 710 | <dd>standard</dd> |
|---|
| 711 | <dt>Author/Change controller:</dt> |
|---|
| 712 | <dd>IETF</dd> |
|---|
| 713 | <dt>Specification document:</dt> |
|---|
| 714 | <dd>this specification (<a href="#header.field.definition" id="rfc.xref.header.field.definition.1" title="Header Field Definition">Section 4</a>) |
|---|
| 715 | </dd> |
|---|
| 716 | </dl> |
|---|
| 717 | <h1 id="rfc.section.9"><a href="#rfc.section.9">9.</a> Acknowledgements |
|---|
| 718 | </h1> |
|---|
| 719 | <p id="rfc.section.9.p.1">Thanks to Adam Barth, Rolf Eike Beer, Bjoern Hoehrmann, Alfred Hoenes, Roar Lauritzsen, Henrik Nordstrom, and Mark Nottingham |
|---|
| 720 | for their valuable feedback. |
|---|
| 721 | </p> |
|---|
| 722 | <h1 id="rfc.references"><a id="rfc.section.10" href="#rfc.section.10">10.</a> References |
|---|
| 723 | </h1> |
|---|
| 724 | <h2 id="rfc.references.1"><a href="#rfc.section.10.1" id="rfc.section.10.1">10.1</a> Normative References |
|---|
| 725 | </h2> |
|---|
| 726 | <table> |
|---|
| 727 | <tr> |
|---|
| 728 | <td class="reference"><b id="ISO-8859-1">[ISO-8859-1]</b></td> |
|---|
| 729 | <td class="top">International Organization for Standardization, “Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1”, ISO/IEC 8859-1:1998, 1998.</td> |
|---|
| 730 | </tr> |
|---|
| 731 | <tr> |
|---|
| 732 | <td class="reference"><b id="RFC2119">[RFC2119]</b></td> |
|---|
| 733 | <td class="top"><a href="mailto:sob@harvard.edu" title="Harvard University">Bradner, S.</a>, “<a href="http://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>”, BCP 14, RFC 2119, March 1997. |
|---|
| 734 | </td> |
|---|
| 735 | </tr> |
|---|
| 736 | <tr> |
|---|
| 737 | <td class="reference"><b id="RFC2616">[RFC2616]</b></td> |
|---|
| 738 | <td class="top"><a href="mailto:fielding@ics.uci.edu" title="University of California, Irvine">Fielding, R.</a>, <a href="mailto:jg@w3.org" title="W3C">Gettys, J.</a>, <a href="mailto:mogul@wrl.dec.com" title="Compaq Computer Corporation">Mogul, J.</a>, <a href="mailto:frystyk@w3.org" title="MIT Laboratory for Computer Science">Frystyk, H.</a>, <a href="mailto:masinter@parc.xerox.com" title="Xerox Corporation">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, and <a href="mailto:timbl@w3.org" title="W3C">T. Berners-Lee</a>, “<a href="http://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>”, RFC 2616, June 1999. |
|---|
| 739 | </td> |
|---|
| 740 | </tr> |
|---|
| 741 | <tr> |
|---|
| 742 | <td class="reference"><b id="RFC5987">[RFC5987]</b></td> |
|---|
| 743 | <td class="top"><a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">Reschke, J.</a>, “<a href="http://tools.ietf.org/html/rfc5987">Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters</a>”, RFC 5987, August 2010. |
|---|
| 744 | </td> |
|---|
| 745 | </tr> |
|---|
| 746 | </table> |
|---|
| 747 | <h2 id="rfc.references.2"><a href="#rfc.section.10.2" id="rfc.section.10.2">10.2</a> Informative References |
|---|
| 748 | </h2> |
|---|
| 749 | <table> |
|---|
| 750 | <tr> |
|---|
| 751 | <td class="reference"><b id="RFC2046">[RFC2046]</b></td> |
|---|
| 752 | <td class="top"><a href="mailto:ned@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:nsb@nsb.fv.com" title="First Virtual Holdings">N. Borenstein</a>, “<a href="http://tools.ietf.org/html/rfc2046">Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types</a>”, RFC 2046, November 1996. |
|---|
| 753 | </td> |
|---|
| 754 | </tr> |
|---|
| 755 | <tr> |
|---|
| 756 | <td class="reference"><b id="RFC2047">[RFC2047]</b></td> |
|---|
| 757 | <td class="top"><a href="mailto:moore@cs.utk.edu" title="University of Tennessee">Moore, K.</a>, “<a href="http://tools.ietf.org/html/rfc2047">MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text</a>”, RFC 2047, November 1996. |
|---|
| 758 | </td> |
|---|
| 759 | </tr> |
|---|
| 760 | <tr> |
|---|
| 761 | <td class="reference"><b id="RFC2183">[RFC2183]</b></td> |
|---|
| 762 | <td class="top"><a href="mailto:rens@century.com" title="New Century Systems">Troost, R.</a>, <a href="mailto:sdorner@qualcomm.com" title="QUALCOMM Incorporated">Dorner, S.</a>, and <a href="mailto:moore@cs.utk.edu" title="Department of Computer Science">K. Moore</a>, “<a href="http://tools.ietf.org/html/rfc2183">Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field</a>”, RFC 2183, August 1997. |
|---|
| 763 | </td> |
|---|
| 764 | </tr> |
|---|
| 765 | <tr> |
|---|
| 766 | <td class="reference"><b id="RFC2231">[RFC2231]</b></td> |
|---|
| 767 | <td class="top"><a href="mailto:ned.freed@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:moore@cs.utk.edu" title="University of Tennessee">K. Moore</a>, “<a href="http://tools.ietf.org/html/rfc2231">MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations</a>”, RFC 2231, November 1997. |
|---|
| 768 | </td> |
|---|
| 769 | </tr> |
|---|
| 770 | <tr> |
|---|
| 771 | <td class="reference"><b id="RFC2388">[RFC2388]</b></td> |
|---|
| 772 | <td class="top"><a href="mailto:masinter@parc.xerox.com" title="Xerox Palo Alto Research Center">Masinter, L.</a>, “<a href="http://tools.ietf.org/html/rfc2388">Returning Values from Forms: multipart/form-data</a>”, RFC 2388, August 1998. |
|---|
| 773 | </td> |
|---|
| 774 | </tr> |
|---|
| 775 | <tr> |
|---|
| 776 | <td class="reference"><b id="RFC3864">[RFC3864]</b></td> |
|---|
| 777 | <td class="top"><a href="mailto:GK-IETF@ninebynine.org" title="Nine by Nine">Klyne, G.</a>, <a href="mailto:mnot@pobox.com" title="BEA Systems">Nottingham, M.</a>, and <a href="mailto:JeffMogul@acm.org" title="HP Labs">J. Mogul</a>, “<a href="http://tools.ietf.org/html/rfc3864">Registration Procedures for Message Header Fields</a>”, BCP 90, RFC 3864, September 2004. |
|---|
| 778 | </td> |
|---|
| 779 | </tr> |
|---|
| 780 | <tr> |
|---|
| 781 | <td class="reference"><b id="RFC3986">[RFC3986]</b></td> |
|---|
| 782 | <td class="top"><a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:fielding@gbiv.com" title="Day Software">Fielding, R.</a>, and <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">L. Masinter</a>, “<a href="http://tools.ietf.org/html/rfc3986">Uniform Resource Identifier (URI): Generic Syntax</a>”, STD 66, RFC 3986, January 2005. |
|---|
| 783 | </td> |
|---|
| 784 | </tr> |
|---|
| 785 | </table> |
|---|
| 786 | <div class="avoidbreak"> |
|---|
| 787 | <h1 id="rfc.authors"><a href="#rfc.authors">Author's Address</a></h1> |
|---|
| 788 | <address class="vcard"><span class="vcardline"><span class="fn">Julian F. Reschke</span><span class="n hidden"><span class="family-name">Reschke</span><span class="given-name">Julian F.</span></span></span><span class="org vcardline">greenbytes GmbH</span><span class="adr"><span class="street-address vcardline">Hafenweg 16</span><span class="vcardline"><span class="locality">Muenster</span>, <span class="region">NW</span> <span class="postal-code">48155</span></span><span class="country-name vcardline">Germany</span></span><span class="vcardline">Email: <a href="mailto:julian.reschke@greenbytes.de"><span class="email">julian.reschke@greenbytes.de</span></a></span><span class="vcardline">URI: <a href="http://greenbytes.de/tech/webdav/" class="url">http://greenbytes.de/tech/webdav/</a></span></address> |
|---|
| 789 | </div> |
|---|
| 790 | <h1 id="rfc.section.A" class="np"><a href="#rfc.section.A">A.</a> <a id="changes.from.rfc2616" href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></h1> |
|---|
| 791 | <p id="rfc.section.A.p.1">Compared to <a href="http://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.10"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, the following normative changes reflecting actual implementations have been made: |
|---|
| 792 | </p> |
|---|
| 793 | <ul> |
|---|
| 794 | <li>According to RFC 2616, the disposition type "attachment" only applies to content of type "application/octet-stream". This |
|---|
| 795 | restriction has been removed, because recipients in practice do not check the content type, and it also discourages properly |
|---|
| 796 | declaring the media type. |
|---|
| 797 | </li> |
|---|
| 798 | <li>RFC 2616 only allows "quoted-string" for the filename parameter. This would be an exceptional parameter syntax, and also doesn't |
|---|
| 799 | reflect actual use. |
|---|
| 800 | </li> |
|---|
| 801 | <li>The definition for the disposition type "inline" (<a href="#RFC2183" id="rfc.xref.RFC2183.6"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.1">Section 2.1</a>) has been re-added with a suggestion for its processing. |
|---|
| 802 | </li> |
|---|
| 803 | <li>This specification requires support for the extended parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.8"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>. |
|---|
| 804 | </li> |
|---|
| 805 | </ul> |
|---|
| 806 | <h1 id="rfc.section.B"><a href="#rfc.section.B">B.</a> <a id="diffs.compared.to.rfc2183" href="#diffs.compared.to.rfc2183">Differences compared to RFC 2183</a></h1> |
|---|
| 807 | <p id="rfc.section.B.p.1"> <a href="http://tools.ietf.org/html/rfc2183#section-2">Section 2</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.7"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines several additional disposition parameters: "creation-date", "modification-date", "quoted-date-time", and "size". The |
|---|
| 808 | majority of user agents does not implement these, thus they have been omitted from this specification. |
|---|
| 809 | </p> |
|---|
| 810 | <h1 id="rfc.section.C"><a href="#rfc.section.C">C.</a> <a id="alternatives" href="#alternatives">Alternative Approaches to Internationalization</a></h1> |
|---|
| 811 | <p id="rfc.section.C.p.1">By default, HTTP header field parameters cannot carry characters outside the ISO-8859-1 (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.2"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>) character encoding (see <a href="#RFC2616" id="rfc.xref.RFC2616.11"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>). For the "filename" parameter, this of course is an unacceptable restriction. |
|---|
| 812 | </p> |
|---|
| 813 | <p id="rfc.section.C.p.2">Unfortunately, user agent implementers have not managed to come up with an interoperable approach, although the IETF Standards |
|---|
| 814 | Track specifies exactly one solution (<a href="#RFC2231" id="rfc.xref.RFC2231.1"><cite title="MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations">[RFC2231]</cite></a>, clarified and profiled for HTTP in <a href="#RFC5987" id="rfc.xref.RFC5987.9"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>). |
|---|
| 815 | </p> |
|---|
| 816 | <p id="rfc.section.C.p.3">For completeness, the sections below describe the various approaches that have been tried, and explains how they are inferior |
|---|
| 817 | to the RFC 5987 encoding used in this specification. |
|---|
| 818 | </p> |
|---|
| 819 | <h2 id="rfc.section.C.1"><a href="#rfc.section.C.1">C.1</a> <a id="alternatives.rfc2047" href="#alternatives.rfc2047">RFC 2047 Encoding</a></h2> |
|---|
| 820 | <p id="rfc.section.C.1.p.1">RFC 2047 defines an encoding mechanism for header fields, but this encoding is not supposed to be used for header field parameters |
|---|
| 821 | - see <a href="http://tools.ietf.org/html/rfc2047#section-5">Section 5</a> of <a href="#RFC2047" id="rfc.xref.RFC2047.1"><cite title="MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text">[RFC2047]</cite></a>: |
|---|
| 822 | </p> |
|---|
| 823 | <blockquote id="rfc.section.C.1.p.2" cite="http://tools.ietf.org/html/rfc2047#section-5"> |
|---|
| 824 | <p>An 'encoded-word' MUST NOT appear within a 'quoted-string'.</p> |
|---|
| 825 | <p>...</p> |
|---|
| 826 | <p>An 'encoded-word' MUST NOT be used in parameter of a MIME Content-Type or Content-Disposition field, or in any structured |
|---|
| 827 | field body except within a 'comment' or 'phrase'. |
|---|
| 828 | </p> |
|---|
| 829 | </blockquote> |
|---|
| 830 | <p id="rfc.section.C.1.p.3">In practice, some user agents implement the encoding, some do not (exposing the encoded string to the user), and some get |
|---|
| 831 | confused by it. |
|---|
| 832 | </p> |
|---|
| 833 | <h2 id="rfc.section.C.2"><a href="#rfc.section.C.2">C.2</a> <a id="alternatives.percent" href="#alternatives.percent">Percent Encoding</a></h2> |
|---|
| 834 | <p id="rfc.section.C.2.p.1">Some user agents accept percent encoded (<a href="#RFC3986" id="rfc.xref.RFC3986.1"><cite title="Uniform Resource Identifier (URI): Generic Syntax">[RFC3986]</cite></a>, <a href="http://tools.ietf.org/html/rfc3986#section-2.1">Section 2.1</a>) sequences of characters. The character encoding being used for decoding depends on various factors, including the encoding |
|---|
| 835 | of the referring page, the user agent's locale, its configuration, and also the actual value of the parameter. |
|---|
| 836 | </p> |
|---|
| 837 | <p id="rfc.section.C.2.p.2">In practice, this is hard to use because those user agents that do not support it will display the escaped character sequence |
|---|
| 838 | to the user. For those user agents that do implement this it is difficult to predict what character encoding they actually |
|---|
| 839 | expect. |
|---|
| 840 | </p> |
|---|
| 841 | <h2 id="rfc.section.C.3"><a href="#rfc.section.C.3">C.3</a> <a id="alternatives.sniff" href="#alternatives.sniff">Encoding Sniffing</a></h2> |
|---|
| 842 | <p id="rfc.section.C.3.p.1">Some user agents inspect the value (which defaults to ISO-8859-1 for the quoted-string form) and switch to UTF-8 when it seems |
|---|
| 843 | to be more likely to be the correct interpretation. |
|---|
| 844 | </p> |
|---|
| 845 | <p id="rfc.section.C.3.p.2">As with the approaches above, this is not interoperable and furthermore risks misinterpreting the actual value.</p> |
|---|
| 846 | <h2 id="rfc.section.C.4"><a href="#rfc.section.C.4">C.4</a> <a id="alternatives.implementations" href="#alternatives.implementations">Implementations (to be removed by RFC Editor before publication)</a></h2> |
|---|
| 847 | <p id="rfc.section.C.4.p.1">Unfortunately, as of March 2011, neither the encoding defined in RFCs 2231 and 5987, nor any of the alternate approaches discussed |
|---|
| 848 | above was implemented interoperably. Thus, this specification recommends the approach defined in RFC 5987, which at least |
|---|
| 849 | has the advantage of actually being specified properly. |
|---|
| 850 | </p> |
|---|
| 851 | <p id="rfc.section.C.4.p.2">The table below shows the implementation support for the various approaches:</p> |
|---|
| 852 | <div id="rfc.table.u.1"> |
|---|
| 853 | <table class="tt full left" cellpadding="3" cellspacing="0"> |
|---|
| 854 | <thead> |
|---|
| 855 | <tr> |
|---|
| 856 | <th>User Agent</th> |
|---|
| 857 | <th>RFC 2231/5987</th> |
|---|
| 858 | <th>RFC 2047</th> |
|---|
| 859 | <th>Percent Encoding</th> |
|---|
| 860 | <th>Encoding Sniffing</th> |
|---|
| 861 | </tr> |
|---|
| 862 | </thead> |
|---|
| 863 | <tbody> |
|---|
| 864 | <tr> |
|---|
| 865 | <td class="left">Chrome</td> |
|---|
| 866 | <td class="left">yes</td> |
|---|
| 867 | <td class="left">yes</td> |
|---|
| 868 | <td class="left">yes</td> |
|---|
| 869 | <td class="left">yes</td> |
|---|
| 870 | </tr> |
|---|
| 871 | <tr> |
|---|
| 872 | <td class="left">Firefox</td> |
|---|
| 873 | <td class="left">yes (*)</td> |
|---|
| 874 | <td class="left">yes</td> |
|---|
| 875 | <td class="left">no</td> |
|---|
| 876 | <td class="left">yes</td> |
|---|
| 877 | </tr> |
|---|
| 878 | <tr> |
|---|
| 879 | <td class="left">Internet Explorer</td> |
|---|
| 880 | <td class="left">yes (**)</td> |
|---|
| 881 | <td class="left">no</td> |
|---|
| 882 | <td class="left">yes</td> |
|---|
| 883 | <td class="left">no</td> |
|---|
| 884 | </tr> |
|---|
| 885 | <tr> |
|---|
| 886 | <td class="left">Konqueror</td> |
|---|
| 887 | <td class="left">yes</td> |
|---|
| 888 | <td class="left">no</td> |
|---|
| 889 | <td class="left">no</td> |
|---|
| 890 | <td class="left">no</td> |
|---|
| 891 | </tr> |
|---|
| 892 | <tr> |
|---|
| 893 | <td class="left">Opera</td> |
|---|
| 894 | <td class="left">yes</td> |
|---|
| 895 | <td class="left">no</td> |
|---|
| 896 | <td class="left">no</td> |
|---|
| 897 | <td class="left">no</td> |
|---|
| 898 | </tr> |
|---|
| 899 | <tr> |
|---|
| 900 | <td class="left">Safari</td> |
|---|
| 901 | <td class="left">no</td> |
|---|
| 902 | <td class="left">no</td> |
|---|
| 903 | <td class="left">no</td> |
|---|
| 904 | <td class="left">yes</td> |
|---|
| 905 | </tr> |
|---|
| 906 | </tbody> |
|---|
| 907 | </table> |
|---|
| 908 | </div> |
|---|
| 909 | <p id="rfc.section.C.4.p.3">(*) Does not implement the fallback behavior to "filename" described in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>; a fix is planned for Firefox 5. |
|---|
| 910 | </p> |
|---|
| 911 | <p id="rfc.section.C.4.p.4">(**) Starting with IE9RC, but only implements UTF-8.</p> |
|---|
| 912 | <h1 id="rfc.section.D"><a href="#rfc.section.D">D.</a> <a id="advice.generating" href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></h1> |
|---|
| 913 | <p id="rfc.section.D.p.1">To successfully interoperate with existing and future user agents, senders of the Content-Disposition header field are advised |
|---|
| 914 | to: |
|---|
| 915 | </p> |
|---|
| 916 | <p id="rfc.section.D.p.2"> </p> |
|---|
| 917 | <ul> |
|---|
| 918 | <li>Include a "filename" parameter when US-ASCII is sufficiently expressive.</li> |
|---|
| 919 | <li>Use the 'token' form of the filename parameter only when it does not contain disallowed characters (e.g., spaces); in such |
|---|
| 920 | cases, the quoted-string form should be used. |
|---|
| 921 | </li> |
|---|
| 922 | <li>Avoid including the percent character followed by two hexadecimal characters (e.g., %A9) in the filename parameter, since |
|---|
| 923 | some existing implementations consider it to be an escape character, while others will pass it through unchanged. |
|---|
| 924 | </li> |
|---|
| 925 | <li>Avoid including the "\" character in the quoted-string form of the filename parameter, as escaping is not implemented by some |
|---|
| 926 | user agents, and can be considered as an illegal path character. |
|---|
| 927 | </li> |
|---|
| 928 | <li>Avoid using non-ASCII characters in the filename parameter. Although most existing implementations will decode them as ISO-8859-1, |
|---|
| 929 | some will apply heuristics to detect UTF-8, and thus might fail on certain names. |
|---|
| 930 | </li> |
|---|
| 931 | <li>Include a "filename*" parameter where the desired filename cannot be expressed faithfully using the "filename" form. Note |
|---|
| 932 | that legacy user agents will not process this, and will fall back to using the "filename" parameter's content. |
|---|
| 933 | </li> |
|---|
| 934 | <li>When a "filename*" parameter is sent, to also generate a "filename" parameter as a fallback for user agents that do not support |
|---|
| 935 | the "filename*" form, if possible. This can be done by substituting characters with US-ASCII sequences (e.g., Unicode character |
|---|
| 936 | point U+00E4 (LATIN SMALL LETTER A WITH DIARESIS) by "ae"). Note that this may not be possible in some locales. |
|---|
| 937 | </li> |
|---|
| 938 | <li>When a "filename" parameter is included as a fallback (as per above), "filename" should occur first, due to parsing problems |
|---|
| 939 | in some existing implementations. <span class="comment" id="fallbackbug">[<a href="#fallbackbug" class="smpl">fallbackbug</a>: Firefox is known to pick the wrong parameter; a bug fix is scheduled for Firefox 5. --jre]</span> |
|---|
| 940 | </li> |
|---|
| 941 | <li>Use UTF-8 as the encoding of the "filename*" parameter, when present, because at least one existing implementation only implements |
|---|
| 942 | that encoding. |
|---|
| 943 | </li> |
|---|
| 944 | </ul> |
|---|
| 945 | <p id="rfc.section.D.p.3">Note that this advice is based upon UA behaviour at the time of writing, and might be superseded. <<a href="http://purl.org/NET/http/content-disposition-tests">http://purl.org/NET/http/content-disposition-tests</a>> provides an overview of current levels of support in various implementations. |
|---|
| 946 | </p> |
|---|
| 947 | <h1 id="rfc.section.E"><a href="#rfc.section.E">E.</a> <a id="change.log" href="#change.log">Change Log (to be removed by RFC Editor before publication)</a></h1> |
|---|
| 948 | <p id="rfc.section.E.p.1">Note: the issues names in the change log entries for draft-reschke-rfc2183-in-http refer to <<a href="http://greenbytes.de/tech/webdav/draft-reschke-rfc2183-in-http-issues.html">http://greenbytes.de/tech/webdav/draft-reschke-rfc2183-in-http-issues.html</a>>. |
|---|
| 949 | </p> |
|---|
| 950 | <h2 id="rfc.section.E.1"><a href="#rfc.section.E.1">E.1</a> Since draft-reschke-rfc2183-in-http-00 |
|---|
| 951 | </h2> |
|---|
| 952 | <p id="rfc.section.E.1.p.1">Adjust terminology ("header" -> "header field"). Update rfc2231-in-http reference.</p> |
|---|
| 953 | <h2 id="rfc.section.E.2"><a href="#rfc.section.E.2">E.2</a> Since draft-reschke-rfc2183-in-http-01 |
|---|
| 954 | </h2> |
|---|
| 955 | <p id="rfc.section.E.2.p.1">Update rfc2231-in-http reference. Actually define the "filename" parameter. Add internationalization considerations. Add examples |
|---|
| 956 | using the RFC 5987 encoding. Add overview over other approaches, plus a table reporting implementation status. Add and resolve |
|---|
| 957 | issue "nodep2183". Add issues "asciivsiso", "deplboth", "quoted", and "registry". |
|---|
| 958 | </p> |
|---|
| 959 | <h2 id="rfc.section.E.3"><a href="#rfc.section.E.3">E.3</a> Since draft-reschke-rfc2183-in-http-02 |
|---|
| 960 | </h2> |
|---|
| 961 | <p id="rfc.section.E.3.p.1">Add and close issue "docfallback". Close issues "asciivsiso", "deplboth", "quoted", and "registry".</p> |
|---|
| 962 | <h2 id="rfc.section.E.4"><a href="#rfc.section.E.4">E.4</a> Since draft-reschke-rfc2183-in-http-03 |
|---|
| 963 | </h2> |
|---|
| 964 | <p id="rfc.section.E.4.p.1">Updated to be a Working Draft of the IETF HTTPbis Working Group.</p> |
|---|
| 965 | <h2 id="rfc.section.E.5"><a href="#rfc.section.E.5">E.5</a> <a id="changes.since.00" href="#changes.since.00">Since draft-ietf-httpbis-content-disp-00</a></h2> |
|---|
| 966 | <p id="rfc.section.E.5.p.1">Closed issues: </p> |
|---|
| 967 | <ul> |
|---|
| 968 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/242">http://tools.ietf.org/wg/httpbis/trac/ticket/242</a>>: "handling of unknown disposition types" |
|---|
| 969 | </li> |
|---|
| 970 | </ul> |
|---|
| 971 | <p id="rfc.section.E.5.p.2">Slightly updated the notes about the proposed fallback behavior.</p> |
|---|
| 972 | <h2 id="rfc.section.E.6"><a href="#rfc.section.E.6">E.6</a> <a id="changes.since.01" href="#changes.since.01">Since draft-ietf-httpbis-content-disp-01</a></h2> |
|---|
| 973 | <p id="rfc.section.E.6.p.1">Various editorial improvements.</p> |
|---|
| 974 | <h2 id="rfc.section.E.7"><a href="#rfc.section.E.7">E.7</a> <a id="changes.since.02" href="#changes.since.02">Since draft-ietf-httpbis-content-disp-02</a></h2> |
|---|
| 975 | <p id="rfc.section.E.7.p.1">Closed issues: </p> |
|---|
| 976 | <ul> |
|---|
| 977 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/244">http://tools.ietf.org/wg/httpbis/trac/ticket/244</a>>: "state that repeating parameters are invalid" |
|---|
| 978 | </li> |
|---|
| 979 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/245">http://tools.ietf.org/wg/httpbis/trac/ticket/245</a>>: "warn about %xx in filenames being misinterpreted" |
|---|
| 980 | </li> |
|---|
| 981 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/246">http://tools.ietf.org/wg/httpbis/trac/ticket/246</a>>: "mention control chars when talking about postprecessing the filename parameter" |
|---|
| 982 | </li> |
|---|
| 983 | </ul> |
|---|
| 984 | <p id="rfc.section.E.7.p.2">Update <a href="#alternatives.implementations" title="Implementations (to be removed by RFC Editor before publication)">Appendix C.4</a>; Opera 10.63 RC implements the recommended fallback behavior. |
|---|
| 985 | </p> |
|---|
| 986 | <h2 id="rfc.section.E.8"><a href="#rfc.section.E.8">E.8</a> <a id="changes.since.03" href="#changes.since.03">Since draft-ietf-httpbis-content-disp-03</a></h2> |
|---|
| 987 | <p id="rfc.section.E.8.p.1">Closed issues: </p> |
|---|
| 988 | <ul> |
|---|
| 989 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/252">http://tools.ietf.org/wg/httpbis/trac/ticket/252</a>>: "'modification-date' *is* implemented in Konq 4.5" |
|---|
| 990 | </li> |
|---|
| 991 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/253">http://tools.ietf.org/wg/httpbis/trac/ticket/253</a>>: "clarify what LWS means for the Content-Disp grammar" |
|---|
| 992 | </li> |
|---|
| 993 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/258">http://tools.ietf.org/wg/httpbis/trac/ticket/258</a>>: "Avoid passive voice in message requirements" |
|---|
| 994 | </li> |
|---|
| 995 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/263">http://tools.ietf.org/wg/httpbis/trac/ticket/263</a>>: "text about historical percent-decoding unclear" |
|---|
| 996 | </li> |
|---|
| 997 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/264">http://tools.ietf.org/wg/httpbis/trac/ticket/264</a>>: "add explanation of language tagging" |
|---|
| 998 | </li> |
|---|
| 999 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/265">http://tools.ietf.org/wg/httpbis/trac/ticket/265</a>>: "Clarify that C-D spec does not apply to multipart upload" |
|---|
| 1000 | </li> |
|---|
| 1001 | </ul> |
|---|
| 1002 | <h2 id="rfc.section.E.9"><a href="#rfc.section.E.9">E.9</a> <a id="changes.since.04" href="#changes.since.04">Since draft-ietf-httpbis-content-disp-04</a></h2> |
|---|
| 1003 | <p id="rfc.section.E.9.p.1">Updated implementation information (Chrome 9 implements RFC 5987, IE 9 RC implements it for UTF-8 only).</p> |
|---|
| 1004 | <p id="rfc.section.E.9.p.2">Clarify who requirements are on, add a section discussing conformance and handling of invalid field values in general.</p> |
|---|
| 1005 | <p id="rfc.section.E.9.p.3">Closed issues: </p> |
|---|
| 1006 | <ul> |
|---|
| 1007 | <li> <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/ticket/243">http://trac.tools.ietf.org/wg/httpbis/trac/ticket/243</a>>: "avoid stating ISO-8859-1 default for header param" (the default is still mentioned, but it was clarified what it applies |
|---|
| 1008 | to). |
|---|
| 1009 | </li> |
|---|
| 1010 | <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/272">http://tools.ietf.org/wg/httpbis/trac/ticket/272</a>>: "Path Separator Characters" |
|---|
| 1011 | </li> |
|---|
| 1012 | </ul> |
|---|
| 1013 | <h2 id="rfc.section.E.10"><a href="#rfc.section.E.10">E.10</a> <a id="changes.since.05" href="#changes.since.05">Since draft-ietf-httpbis-content-disp-05</a></h2> |
|---|
| 1014 | <p id="rfc.section.E.10.p.1">Editorial changes: Fixed two typos where the new Conformance section said "Content-Location" instead of "Content-Disposition". |
|---|
| 1015 | Cleaned up terminology ("user agent", "recipient", "sender", "message body", ...). Stated what the escape character for quoted-string |
|---|
| 1016 | is. Explained a use case for "inline" disposition type. Updated implementation notes with respect to the fallback behavior. |
|---|
| 1017 | </p> |
|---|
| 1018 | <p id="rfc.section.E.10.p.2">Added appendix "Advice on Generating Content-Disposition Header Fields".</p> |
|---|
| 1019 | <h2 id="rfc.section.E.11"><a href="#rfc.section.E.11">E.11</a> <a id="changes.since.06" href="#changes.since.06">Since draft-ietf-httpbis-content-disp-06</a></h2> |
|---|
| 1020 | <p id="rfc.section.E.11.p.1">Closed issues: </p> |
|---|
| 1021 | <ul> |
|---|
| 1022 | <li> <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/ticket/278">http://trac.tools.ietf.org/wg/httpbis/trac/ticket/278</a>>: "conformance language" |
|---|
| 1023 | </li> |
|---|
| 1024 | </ul> |
|---|
| 1025 | <h1 id="rfc.index"><a href="#rfc.index">Index</a></h1> |
|---|
| 1026 | <p class="noprint"><a href="#rfc.index.C">C</a> <a href="#rfc.index.H">H</a> <a href="#rfc.index.I">I</a> <a href="#rfc.index.R">R</a> |
|---|
| 1027 | </p> |
|---|
| 1028 | <div class="print2col"> |
|---|
| 1029 | <ul class="ind"> |
|---|
| 1030 | <li><a id="rfc.index.C" href="#rfc.index.C"><b>C</b></a><ul> |
|---|
| 1031 | <li>Content-Disposition header field <a href="#rfc.iref.c.1"><b>4</b></a>, <a href="#rfc.xref.header.field.definition.1">8.2</a></li> |
|---|
| 1032 | </ul> |
|---|
| 1033 | </li> |
|---|
| 1034 | <li><a id="rfc.index.H" href="#rfc.index.H"><b>H</b></a><ul> |
|---|
| 1035 | <li>Header Fields |
|---|
| 1036 | <ul> |
|---|
| 1037 | <li>Content-Disposition <a href="#rfc.iref.h.1"><b>4</b></a>, <a href="#rfc.xref.header.field.definition.1">8.2</a></li> |
|---|
| 1038 | </ul> |
|---|
| 1039 | </li> |
|---|
| 1040 | </ul> |
|---|
| 1041 | </li> |
|---|
| 1042 | <li><a id="rfc.index.I" href="#rfc.index.I"><b>I</b></a><ul> |
|---|
| 1043 | <li><em>ISO-8859-1</em> <a href="#rfc.xref.ISO-8859-1.1">4.3</a>, <a href="#ISO-8859-1"><b>10.1</b></a>, <a href="#rfc.xref.ISO-8859-1.2">C</a></li> |
|---|
| 1044 | </ul> |
|---|
| 1045 | </li> |
|---|
| 1046 | <li><a id="rfc.index.R" href="#rfc.index.R"><b>R</b></a><ul> |
|---|
| 1047 | <li><em>RFC2046</em> <a href="#rfc.xref.RFC2046.1">4.3</a>, <a href="#RFC2046"><b>10.2</b></a></li> |
|---|
| 1048 | <li><em>RFC2047</em> <a href="#RFC2047"><b>10.2</b></a>, <a href="#rfc.xref.RFC2047.1">C.1</a><ul> |
|---|
| 1049 | <li><em>Section 5</em> <a href="#rfc.xref.RFC2047.1">C.1</a></li> |
|---|
| 1050 | </ul> |
|---|
| 1051 | </li> |
|---|
| 1052 | <li><em>RFC2119</em> <a href="#rfc.xref.RFC2119.1">2</a>, <a href="#RFC2119"><b>10.1</b></a></li> |
|---|
| 1053 | <li><em>RFC2183</em> <a href="#rfc.xref.RFC2183.1">1</a>, <a href="#rfc.xref.RFC2183.2">4.2</a>, <a href="#rfc.xref.RFC2183.3">4.4</a>, <a href="#rfc.xref.RFC2183.4">4.5</a>, <a href="#rfc.xref.RFC2183.5">8.1</a>, <a href="#RFC2183"><b>10.2</b></a>, <a href="#rfc.xref.RFC2183.6">A</a>, <a href="#rfc.xref.RFC2183.7">B</a><ul> |
|---|
| 1054 | <li><em>Section 2</em> <a href="#rfc.xref.RFC2183.7">B</a></li> |
|---|
| 1055 | <li><em>Section 2.1</em> <a href="#rfc.xref.RFC2183.6">A</a></li> |
|---|
| 1056 | <li><em>Section 2.8</em> <a href="#rfc.xref.RFC2183.2">4.2</a>, <a href="#rfc.xref.RFC2183.3">4.4</a></li> |
|---|
| 1057 | <li><em>Section 9</em> <a href="#rfc.xref.RFC2183.4">4.5</a>, <a href="#rfc.xref.RFC2183.5">8.1</a></li> |
|---|
| 1058 | </ul> |
|---|
| 1059 | </li> |
|---|
| 1060 | <li><em>RFC2231</em> <a href="#RFC2231"><b>10.2</b></a>, <a href="#rfc.xref.RFC2231.1">C</a></li> |
|---|
| 1061 | <li><em>RFC2388</em> <a href="#rfc.xref.RFC2388.1">1</a>, <a href="#RFC2388"><b>10.2</b></a></li> |
|---|
| 1062 | <li><em>RFC2616</em> <a href="#rfc.xref.RFC2616.1">1</a>, <a href="#rfc.xref.RFC2616.2">1</a>, <a href="#rfc.xref.RFC2616.3">2</a>, <a href="#rfc.xref.RFC2616.4">4.1</a>, <a href="#rfc.xref.RFC2616.5">4.1</a>, <a href="#rfc.xref.RFC2616.6">4.1</a>, <a href="#rfc.xref.RFC2616.7">4.1</a>, <a href="#rfc.xref.RFC2616.8">4.1</a>, <a href="#rfc.xref.RFC2616.9">7</a>, <a href="#RFC2616"><b>10.1</b></a>, <a href="#rfc.xref.RFC2616.10">A</a>, <a href="#rfc.xref.RFC2616.11">C</a><ul> |
|---|
| 1063 | <li><em>Section 2.1</em> <a href="#rfc.xref.RFC2616.3">2</a>, <a href="#rfc.xref.RFC2616.8">4.1</a></li> |
|---|
| 1064 | <li><em>Section 2.2</em> <a href="#rfc.xref.RFC2616.5">4.1</a>, <a href="#rfc.xref.RFC2616.6">4.1</a>, <a href="#rfc.xref.RFC2616.11">C</a></li> |
|---|
| 1065 | <li><em>Section 3.6</em> <a href="#rfc.xref.RFC2616.7">4.1</a></li> |
|---|
| 1066 | <li><em>Section 15.5</em> <a href="#rfc.xref.RFC2616.2">1</a></li> |
|---|
| 1067 | <li><em>Section 15</em> <a href="#rfc.xref.RFC2616.9">7</a></li> |
|---|
| 1068 | <li><em>Section 19.5.1</em> <a href="#rfc.xref.RFC2616.1">1</a>, <a href="#rfc.xref.RFC2616.10">A</a></li> |
|---|
| 1069 | </ul> |
|---|
| 1070 | </li> |
|---|
| 1071 | <li><em>RFC3864</em> <a href="#rfc.xref.RFC3864.1">8.2</a>, <a href="#RFC3864"><b>10.2</b></a></li> |
|---|
| 1072 | <li><em>RFC3986</em> <a href="#RFC3986"><b>10.2</b></a>, <a href="#rfc.xref.RFC3986.1">C.2</a><ul> |
|---|
| 1073 | <li><em>Section 2.1</em> <a href="#rfc.xref.RFC3986.1">C.2</a></li> |
|---|
| 1074 | </ul> |
|---|
| 1075 | </li> |
|---|
| 1076 | <li><em>RFC5987</em> <a href="#rfc.xref.RFC5987.1">4.1</a>, <a href="#rfc.xref.RFC5987.2">4.1</a>, <a href="#rfc.xref.RFC5987.3">4.3</a>, <a href="#rfc.xref.RFC5987.4">5</a>, <a href="#rfc.xref.RFC5987.5">6</a>, <a href="#rfc.xref.RFC5987.6">7</a>, <a href="#rfc.xref.RFC5987.7">7</a>, <a href="#RFC5987"><b>10.1</b></a>, <a href="#rfc.xref.RFC5987.8">A</a>, <a href="#rfc.xref.RFC5987.9">C</a><ul> |
|---|
| 1077 | <li><em>Section 3.2</em> <a href="#rfc.xref.RFC5987.2">4.1</a></li> |
|---|
| 1078 | <li><em>Section 5</em> <a href="#rfc.xref.RFC5987.7">7</a></li> |
|---|
| 1079 | </ul> |
|---|
| 1080 | </li> |
|---|
| 1081 | </ul> |
|---|
| 1082 | </li> |
|---|
| 1083 | </ul> |
|---|
| 1084 | </div> |
|---|
| 1085 | </body> |
|---|
| 1086 | </html> |
|---|
![(please configure the [header_logo] section in trac.ini)](https://www.ietf.org/images/ietflogotrans.gif)
