| 1 | <!DOCTYPE html |
|---|
| 2 | PUBLIC "-//W3C//DTD HTML 4.01//EN"> |
|---|
| 3 | <html lang="en"> |
|---|
| 4 | <head profile="http://www.w3.org/2006/03/hcard http://dublincore.org/documents/2008/08/04/dc-html/"> |
|---|
| 5 | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> |
|---|
| 6 | <title>Use of the Content-Disposition Header Field |
|---|
| 7 | in the Hypertext Transfer Protocol (HTTP) |
|---|
| 8 | </title><style type="text/css" title="Xml2Rfc (sans serif)"> |
|---|
| 9 | a { |
|---|
| 10 | text-decoration: none; |
|---|
| 11 | } |
|---|
| 12 | a.smpl { |
|---|
| 13 | color: black; |
|---|
| 14 | } |
|---|
| 15 | a:hover { |
|---|
| 16 | text-decoration: underline; |
|---|
| 17 | } |
|---|
| 18 | a:active { |
|---|
| 19 | text-decoration: underline; |
|---|
| 20 | } |
|---|
| 21 | address { |
|---|
| 22 | margin-top: 1em; |
|---|
| 23 | margin-left: 2em; |
|---|
| 24 | font-style: normal; |
|---|
| 25 | } |
|---|
| 26 | blockquote { |
|---|
| 27 | border-style: solid; |
|---|
| 28 | border-color: gray; |
|---|
| 29 | border-width: 0 0 0 .25em; |
|---|
| 30 | font-style: italic; |
|---|
| 31 | padding-left: 0.5em; |
|---|
| 32 | } |
|---|
| 33 | body { |
|---|
| 34 | color: black; |
|---|
| 35 | font-family: verdana, helvetica, arial, sans-serif; |
|---|
| 36 | font-size: 10pt; |
|---|
| 37 | } |
|---|
| 38 | cite { |
|---|
| 39 | font-style: normal; |
|---|
| 40 | } |
|---|
| 41 | div.note { |
|---|
| 42 | margin-left: 2em; |
|---|
| 43 | } |
|---|
| 44 | dd { |
|---|
| 45 | margin-right: 2em; |
|---|
| 46 | } |
|---|
| 47 | dl { |
|---|
| 48 | margin-left: 2em; |
|---|
| 49 | } |
|---|
| 50 | |
|---|
| 51 | ul.empty { |
|---|
| 52 | list-style-type: none; |
|---|
| 53 | } |
|---|
| 54 | ul.empty li { |
|---|
| 55 | margin-top: .5em; |
|---|
| 56 | } |
|---|
| 57 | dl p { |
|---|
| 58 | margin-left: 0em; |
|---|
| 59 | } |
|---|
| 60 | dt { |
|---|
| 61 | margin-top: .5em; |
|---|
| 62 | } |
|---|
| 63 | h1 { |
|---|
| 64 | font-size: 14pt; |
|---|
| 65 | line-height: 21pt; |
|---|
| 66 | page-break-after: avoid; |
|---|
| 67 | } |
|---|
| 68 | h1.np { |
|---|
| 69 | page-break-before: always; |
|---|
| 70 | } |
|---|
| 71 | h1 a { |
|---|
| 72 | color: #333333; |
|---|
| 73 | } |
|---|
| 74 | h2 { |
|---|
| 75 | font-size: 12pt; |
|---|
| 76 | line-height: 15pt; |
|---|
| 77 | page-break-after: avoid; |
|---|
| 78 | } |
|---|
| 79 | h3, h4, h5, h6 { |
|---|
| 80 | font-size: 10pt; |
|---|
| 81 | page-break-after: avoid; |
|---|
| 82 | } |
|---|
| 83 | h2 a, h3 a, h4 a, h5 a, h6 a { |
|---|
| 84 | color: black; |
|---|
| 85 | } |
|---|
| 86 | img { |
|---|
| 87 | margin-left: 3em; |
|---|
| 88 | } |
|---|
| 89 | li { |
|---|
| 90 | margin-left: 2em; |
|---|
| 91 | margin-right: 2em; |
|---|
| 92 | } |
|---|
| 93 | ol { |
|---|
| 94 | margin-left: 2em; |
|---|
| 95 | margin-right: 2em; |
|---|
| 96 | } |
|---|
| 97 | ol.la { |
|---|
| 98 | list-style-type: lower-alpha; |
|---|
| 99 | } |
|---|
| 100 | ol.ua { |
|---|
| 101 | list-style-type: upper-alpha; |
|---|
| 102 | } |
|---|
| 103 | ol p { |
|---|
| 104 | margin-left: 0em; |
|---|
| 105 | } |
|---|
| 106 | p { |
|---|
| 107 | margin-left: 2em; |
|---|
| 108 | margin-right: 2em; |
|---|
| 109 | } |
|---|
| 110 | pre { |
|---|
| 111 | margin-left: 3em; |
|---|
| 112 | background-color: lightyellow; |
|---|
| 113 | padding: .25em; |
|---|
| 114 | } |
|---|
| 115 | pre.text2 { |
|---|
| 116 | border-style: dotted; |
|---|
| 117 | border-width: 1px; |
|---|
| 118 | background-color: #f0f0f0; |
|---|
| 119 | width: 69em; |
|---|
| 120 | } |
|---|
| 121 | pre.inline { |
|---|
| 122 | background-color: white; |
|---|
| 123 | padding: 0em; |
|---|
| 124 | } |
|---|
| 125 | pre.text { |
|---|
| 126 | border-style: dotted; |
|---|
| 127 | border-width: 1px; |
|---|
| 128 | background-color: #f8f8f8; |
|---|
| 129 | width: 69em; |
|---|
| 130 | } |
|---|
| 131 | pre.drawing { |
|---|
| 132 | border-style: solid; |
|---|
| 133 | border-width: 1px; |
|---|
| 134 | background-color: #f8f8f8; |
|---|
| 135 | padding: 2em; |
|---|
| 136 | } |
|---|
| 137 | table { |
|---|
| 138 | margin-left: 2em; |
|---|
| 139 | } |
|---|
| 140 | table.header { |
|---|
| 141 | border-spacing: 1px; |
|---|
| 142 | width: 95%; |
|---|
| 143 | font-size: 10pt; |
|---|
| 144 | color: white; |
|---|
| 145 | } |
|---|
| 146 | td.top { |
|---|
| 147 | vertical-align: top; |
|---|
| 148 | } |
|---|
| 149 | td.topnowrap { |
|---|
| 150 | vertical-align: top; |
|---|
| 151 | white-space: nowrap; |
|---|
| 152 | } |
|---|
| 153 | table.header td { |
|---|
| 154 | background-color: gray; |
|---|
| 155 | width: 50%; |
|---|
| 156 | } |
|---|
| 157 | table.header a { |
|---|
| 158 | color: white; |
|---|
| 159 | } |
|---|
| 160 | td.reference { |
|---|
| 161 | vertical-align: top; |
|---|
| 162 | white-space: nowrap; |
|---|
| 163 | padding-right: 1em; |
|---|
| 164 | } |
|---|
| 165 | thead { |
|---|
| 166 | display:table-header-group; |
|---|
| 167 | } |
|---|
| 168 | ul.toc, ul.toc ul { |
|---|
| 169 | list-style: none; |
|---|
| 170 | margin-left: 1.5em; |
|---|
| 171 | margin-right: 0em; |
|---|
| 172 | padding-left: 0em; |
|---|
| 173 | } |
|---|
| 174 | ul.toc li { |
|---|
| 175 | line-height: 150%; |
|---|
| 176 | font-weight: bold; |
|---|
| 177 | font-size: 10pt; |
|---|
| 178 | margin-left: 0em; |
|---|
| 179 | margin-right: 0em; |
|---|
| 180 | } |
|---|
| 181 | ul.toc li li { |
|---|
| 182 | line-height: normal; |
|---|
| 183 | font-weight: normal; |
|---|
| 184 | font-size: 9pt; |
|---|
| 185 | margin-left: 0em; |
|---|
| 186 | margin-right: 0em; |
|---|
| 187 | } |
|---|
| 188 | li.excluded { |
|---|
| 189 | font-size: 0pt; |
|---|
| 190 | } |
|---|
| 191 | ul p { |
|---|
| 192 | margin-left: 0em; |
|---|
| 193 | } |
|---|
| 194 | .bcp14 { |
|---|
| 195 | font-style: normal; |
|---|
| 196 | text-transform: lowercase; |
|---|
| 197 | font-variant: small-caps; |
|---|
| 198 | } |
|---|
| 199 | blockquote > * .bcp14 { |
|---|
| 200 | font-style: italic; |
|---|
| 201 | } |
|---|
| 202 | .comment { |
|---|
| 203 | background-color: yellow; |
|---|
| 204 | } |
|---|
| 205 | .center { |
|---|
| 206 | text-align: center; |
|---|
| 207 | } |
|---|
| 208 | .error { |
|---|
| 209 | color: red; |
|---|
| 210 | font-style: italic; |
|---|
| 211 | font-weight: bold; |
|---|
| 212 | } |
|---|
| 213 | .figure { |
|---|
| 214 | font-weight: bold; |
|---|
| 215 | text-align: center; |
|---|
| 216 | font-size: 9pt; |
|---|
| 217 | } |
|---|
| 218 | .filename { |
|---|
| 219 | color: #333333; |
|---|
| 220 | font-weight: bold; |
|---|
| 221 | font-size: 12pt; |
|---|
| 222 | line-height: 21pt; |
|---|
| 223 | text-align: center; |
|---|
| 224 | } |
|---|
| 225 | .fn { |
|---|
| 226 | font-weight: bold; |
|---|
| 227 | } |
|---|
| 228 | .hidden { |
|---|
| 229 | display: none; |
|---|
| 230 | } |
|---|
| 231 | .left { |
|---|
| 232 | text-align: left; |
|---|
| 233 | } |
|---|
| 234 | .right { |
|---|
| 235 | text-align: right; |
|---|
| 236 | } |
|---|
| 237 | .title { |
|---|
| 238 | color: #990000; |
|---|
| 239 | font-size: 18pt; |
|---|
| 240 | line-height: 18pt; |
|---|
| 241 | font-weight: bold; |
|---|
| 242 | text-align: center; |
|---|
| 243 | margin-top: 36pt; |
|---|
| 244 | } |
|---|
| 245 | .vcardline { |
|---|
| 246 | display: block; |
|---|
| 247 | } |
|---|
| 248 | .warning { |
|---|
| 249 | font-size: 14pt; |
|---|
| 250 | background-color: yellow; |
|---|
| 251 | } |
|---|
| 252 | |
|---|
| 253 | |
|---|
| 254 | @media print { |
|---|
| 255 | .noprint { |
|---|
| 256 | display: none; |
|---|
| 257 | } |
|---|
| 258 | |
|---|
| 259 | a { |
|---|
| 260 | color: black; |
|---|
| 261 | text-decoration: none; |
|---|
| 262 | } |
|---|
| 263 | |
|---|
| 264 | table.header { |
|---|
| 265 | width: 90%; |
|---|
| 266 | } |
|---|
| 267 | |
|---|
| 268 | td.header { |
|---|
| 269 | width: 50%; |
|---|
| 270 | color: black; |
|---|
| 271 | background-color: white; |
|---|
| 272 | vertical-align: top; |
|---|
| 273 | font-size: 12pt; |
|---|
| 274 | } |
|---|
| 275 | |
|---|
| 276 | ul.toc a::after { |
|---|
| 277 | content: leader('.') target-counter(attr(href), page); |
|---|
| 278 | } |
|---|
| 279 | |
|---|
| 280 | ul.ind li li a { |
|---|
| 281 | content: target-counter(attr(href), page); |
|---|
| 282 | } |
|---|
| 283 | |
|---|
| 284 | .print2col { |
|---|
| 285 | column-count: 2; |
|---|
| 286 | -moz-column-count: 2; |
|---|
| 287 | column-fill: auto; |
|---|
| 288 | } |
|---|
| 289 | } |
|---|
| 290 | |
|---|
| 291 | @page { |
|---|
| 292 | @top-left { |
|---|
| 293 | content: "Internet-Draft"; |
|---|
| 294 | } |
|---|
| 295 | @top-right { |
|---|
| 296 | content: "June 2011"; |
|---|
| 297 | } |
|---|
| 298 | @top-center { |
|---|
| 299 | content: "Content-Disposition in HTTP"; |
|---|
| 300 | } |
|---|
| 301 | @bottom-left { |
|---|
| 302 | content: "Reschke"; |
|---|
| 303 | } |
|---|
| 304 | @bottom-center { |
|---|
| 305 | content: "Expires December 8, 2011"; |
|---|
| 306 | } |
|---|
| 307 | @bottom-right { |
|---|
| 308 | content: "[Page " counter(page) "]"; |
|---|
| 309 | } |
|---|
| 310 | } |
|---|
| 311 | |
|---|
| 312 | @page:first { |
|---|
| 313 | @top-left { |
|---|
| 314 | content: normal; |
|---|
| 315 | } |
|---|
| 316 | @top-right { |
|---|
| 317 | content: normal; |
|---|
| 318 | } |
|---|
| 319 | @top-center { |
|---|
| 320 | content: normal; |
|---|
| 321 | } |
|---|
| 322 | } |
|---|
| 323 | </style><link rel="Contents" href="#rfc.toc"> |
|---|
| 324 | <link rel="Author" href="#rfc.authors"> |
|---|
| 325 | <link rel="Copyright" href="#rfc.copyrightnotice"> |
|---|
| 326 | <link rel="Chapter" title="1 Introduction" href="#rfc.section.1"> |
|---|
| 327 | <link rel="Chapter" title="2 Notational Conventions" href="#rfc.section.2"> |
|---|
| 328 | <link rel="Chapter" title="3 Conformance and Error Handling" href="#rfc.section.3"> |
|---|
| 329 | <link rel="Chapter" title="4 Header Field Definition" href="#rfc.section.4"> |
|---|
| 330 | <link rel="Chapter" title="5 Examples" href="#rfc.section.5"> |
|---|
| 331 | <link rel="Chapter" title="6 Internationalization Considerations" href="#rfc.section.6"> |
|---|
| 332 | <link rel="Chapter" title="7 Security Considerations" href="#rfc.section.7"> |
|---|
| 333 | <link rel="Chapter" title="8 IANA Considerations" href="#rfc.section.8"> |
|---|
| 334 | <link rel="Chapter" title="9 Acknowledgements" href="#rfc.section.9"> |
|---|
| 335 | <link rel="Chapter" href="#rfc.section.10" title="10 References"> |
|---|
| 336 | <link rel="Appendix" title="A Changes from the RFC 2616 Definition" href="#rfc.section.A"> |
|---|
| 337 | <link rel="Appendix" title="B Differences Compared to RFC 2183" href="#rfc.section.B"> |
|---|
| 338 | <link rel="Appendix" title="C Alternative Approaches to Internationalization" href="#rfc.section.C"> |
|---|
| 339 | <link rel="Appendix" title="D Advice on Generating Content-Disposition Header Fields" href="#rfc.section.D"> |
|---|
| 340 | <link rel="Alternate" title="RFC6266" href="http://greenbytes.de/tech/webdav/rfc6266.html"> |
|---|
| 341 | <meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1.550, 2011-05-30 14:02:12, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/"> |
|---|
| 342 | <meta name="keywords" content="HTTP, Hypertext Transfer Protocol, Content-Disposition, filename, attachment, inline"> |
|---|
| 343 | <link rel="schema.dct" href="http://purl.org/dc/terms/"> |
|---|
| 344 | <meta name="dct.creator" content="Reschke, J. F."> |
|---|
| 345 | <meta name="dct.identifier" content="urn:ietf:id:draft-ietf-httpbis-content-disp-latest"> |
|---|
| 346 | <meta name="dct.issued" scheme="ISO8601" content="2011-06-06"> |
|---|
| 347 | <meta name="dct.abstract" content="RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization aspects."> |
|---|
| 348 | <meta name="description" content="RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization aspects."> |
|---|
| 349 | </head> |
|---|
| 350 | <body> |
|---|
| 351 | <table class="header"> |
|---|
| 352 | <tbody> |
|---|
| 353 | <tr> |
|---|
| 354 | <td class="left">HTTPbis Working Group</td> |
|---|
| 355 | <td class="right">J. Reschke</td> |
|---|
| 356 | </tr> |
|---|
| 357 | <tr> |
|---|
| 358 | <td class="left">Internet-Draft</td> |
|---|
| 359 | <td class="right">greenbytes</td> |
|---|
| 360 | </tr> |
|---|
| 361 | <tr> |
|---|
| 362 | <td class="left">Updates: <a href="http://tools.ietf.org/html/rfc2616">2616</a> (if approved) |
|---|
| 363 | </td> |
|---|
| 364 | <td class="right">June 6, 2011</td> |
|---|
| 365 | </tr> |
|---|
| 366 | <tr> |
|---|
| 367 | <td class="left">Intended status: Standards Track</td> |
|---|
| 368 | <td class="right"></td> |
|---|
| 369 | </tr> |
|---|
| 370 | <tr> |
|---|
| 371 | <td class="left">Expires: December 8, 2011</td> |
|---|
| 372 | <td class="right"></td> |
|---|
| 373 | </tr> |
|---|
| 374 | </tbody> |
|---|
| 375 | </table> |
|---|
| 376 | <p class="title">Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)<br><span class="filename">draft-ietf-httpbis-content-disp-latest</span></p> |
|---|
| 377 | <p style="color: green; text-align: center; font-size: 14pt; background-color: yellow;"><b>Note:</b> a later version of this document has been published as <a href="http://greenbytes.de/tech/webdav/rfc6266.html">RFC6266</a>. |
|---|
| 378 | |
|---|
| 379 | </p> |
|---|
| 380 | <h1 id="rfc.abstract"><a href="#rfc.abstract">Abstract</a></h1> |
|---|
| 381 | <p>RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. |
|---|
| 382 | This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization |
|---|
| 383 | aspects. |
|---|
| 384 | </p> |
|---|
| 385 | <h1><a id="rfc.status" href="#rfc.status">Status of This Memo</a></h1> |
|---|
| 386 | <p>This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.</p> |
|---|
| 387 | <p>Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute |
|---|
| 388 | working documents as Internet-Drafts. The list of current Internet-Drafts is at <a href="http://datatracker.ietf.org/drafts/current/">http://datatracker.ietf.org/drafts/current/</a>. |
|---|
| 389 | </p> |
|---|
| 390 | <p>Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other |
|---|
| 391 | documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work |
|---|
| 392 | in progress”. |
|---|
| 393 | </p> |
|---|
| 394 | <p>This Internet-Draft will expire on December 8, 2011.</p> |
|---|
| 395 | <h1><a id="rfc.copyrightnotice" href="#rfc.copyrightnotice">Copyright Notice</a></h1> |
|---|
| 396 | <p>Copyright © 2011 IETF Trust and the persons identified as the document authors. All rights reserved.</p> |
|---|
| 397 | <p>This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights |
|---|
| 398 | and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License |
|---|
| 399 | text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified |
|---|
| 400 | BSD License. |
|---|
| 401 | </p> |
|---|
| 402 | <hr class="noprint"> |
|---|
| 403 | <h1 class="np" id="rfc.toc"><a href="#rfc.toc">Table of Contents</a></h1> |
|---|
| 404 | <ul class="toc"> |
|---|
| 405 | <li>1. <a href="#introduction">Introduction</a></li> |
|---|
| 406 | <li>2. <a href="#notational.conventions">Notational Conventions</a></li> |
|---|
| 407 | <li>3. <a href="#conformance.and.error.handling">Conformance and Error Handling</a></li> |
|---|
| 408 | <li>4. <a href="#header.field.definition">Header Field Definition</a><ul> |
|---|
| 409 | <li>4.1 <a href="#rfc.section.4.1">Grammar</a></li> |
|---|
| 410 | <li>4.2 <a href="#disposition.type">Disposition Type</a></li> |
|---|
| 411 | <li>4.3 <a href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></li> |
|---|
| 412 | <li>4.4 <a href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></li> |
|---|
| 413 | <li>4.5 <a href="#extensibility">Extensibility</a></li> |
|---|
| 414 | </ul> |
|---|
| 415 | </li> |
|---|
| 416 | <li>5. <a href="#examples">Examples</a></li> |
|---|
| 417 | <li>6. <a href="#i18n">Internationalization Considerations</a></li> |
|---|
| 418 | <li>7. <a href="#security.considerations">Security Considerations</a></li> |
|---|
| 419 | <li>8. <a href="#iana.considerations">IANA Considerations</a><ul> |
|---|
| 420 | <li>8.1 <a href="#registry">Registry for Disposition Values and Parameters</a></li> |
|---|
| 421 | <li>8.2 <a href="#header.field.registration">Header Field Registration</a></li> |
|---|
| 422 | </ul> |
|---|
| 423 | </li> |
|---|
| 424 | <li>9. <a href="#rfc.section.9">Acknowledgements</a></li> |
|---|
| 425 | <li>10. <a href="#rfc.references">References</a><ul> |
|---|
| 426 | <li>10.1 <a href="#rfc.references.1">Normative References</a></li> |
|---|
| 427 | <li>10.2 <a href="#rfc.references.2">Informative References</a></li> |
|---|
| 428 | </ul> |
|---|
| 429 | </li> |
|---|
| 430 | <li><a href="#rfc.authors">Author's Address</a></li> |
|---|
| 431 | <li>A. <a href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></li> |
|---|
| 432 | <li>B. <a href="#diffs.compared.to.rfc2183">Differences Compared to RFC 2183</a></li> |
|---|
| 433 | <li>C. <a href="#alternatives">Alternative Approaches to Internationalization</a><ul> |
|---|
| 434 | <li>C.1 <a href="#alternatives.rfc2047">RFC 2047 Encoding</a></li> |
|---|
| 435 | <li>C.2 <a href="#alternatives.percent">Percent Encoding</a></li> |
|---|
| 436 | <li>C.3 <a href="#alternatives.sniff">Encoding Sniffing</a></li> |
|---|
| 437 | </ul> |
|---|
| 438 | </li> |
|---|
| 439 | <li>D. <a href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></li> |
|---|
| 440 | </ul> |
|---|
| 441 | <h1 id="rfc.section.1" class="np"><a href="#rfc.section.1">1.</a> <a id="introduction" href="#introduction">Introduction</a></h1> |
|---|
| 442 | <p id="rfc.section.1.p.1">RFC 2616 defines the Content-Disposition response header field (<a href="http://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.1"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>) but points out that it is not part of the HTTP/1.1 Standard (<a href="http://tools.ietf.org/html/rfc2616#section-15.5" id="rfc.xref.RFC2616.2">Section 15.5</a>): |
|---|
| 443 | </p> |
|---|
| 444 | <blockquote id="rfc.section.1.p.2" cite="http://tools.ietf.org/html/rfc2616#section-15.5"> |
|---|
| 445 | <p>Content-Disposition is not part of the HTTP standard, but since it is widely implemented, we are documenting its use and risks |
|---|
| 446 | for implementers. |
|---|
| 447 | </p> |
|---|
| 448 | </blockquote> |
|---|
| 449 | <p id="rfc.section.1.p.3">This specification takes over the definition and registration of Content-Disposition, as used in HTTP. Based on interoperability |
|---|
| 450 | testing with existing user agents (UAs), it fully defines a profile of the features defined in the Multipurpose Internet Mail |
|---|
| 451 | Extensions (MIME) variant (<a href="#RFC2183" id="rfc.xref.RFC2183.1"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>) of the header field, and also clarifies internationalization aspects. |
|---|
| 452 | </p> |
|---|
| 453 | <div class="note" id="rfc.section.1.p.4"> |
|---|
| 454 | <p> <b>Note:</b> This document does not apply to Content-Disposition header fields appearing in payload bodies transmitted over HTTP, such |
|---|
| 455 | as when using the media type "multipart/form-data" (<a href="#RFC2388" id="rfc.xref.RFC2388.1"><cite title="Returning Values from Forms: multipart/form-data">[RFC2388]</cite></a>). |
|---|
| 456 | </p> |
|---|
| 457 | </div> |
|---|
| 458 | <h1 id="rfc.section.2"><a href="#rfc.section.2">2.</a> <a id="notational.conventions" href="#notational.conventions">Notational Conventions</a></h1> |
|---|
| 459 | <p id="rfc.section.2.p.1">The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" |
|---|
| 460 | in this document are to be interpreted as described in <a href="#RFC2119" id="rfc.xref.RFC2119.1"><cite title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</cite></a>. |
|---|
| 461 | </p> |
|---|
| 462 | <p id="rfc.section.2.p.2">This specification uses the augmented BNF (ABNF) notation defined in <a href="http://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.3"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, including its rules for implied linear whitespace (LWS). |
|---|
| 463 | </p> |
|---|
| 464 | <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> <a id="conformance.and.error.handling" href="#conformance.and.error.handling">Conformance and Error Handling</a></h1> |
|---|
| 465 | <p id="rfc.section.3.p.1">This specification defines conformance criteria for both senders (usually, HTTP origin servers) and recipients (usually, HTTP |
|---|
| 466 | user agents) of the Content-Disposition header field. An implementation is considered conformant if it complies with all of |
|---|
| 467 | the requirements associated with its role. |
|---|
| 468 | </p> |
|---|
| 469 | <p id="rfc.section.3.p.2">This specification also defines certain forms of the header field value to be invalid, using both ABNF and prose requirements |
|---|
| 470 | (<a href="#header.field.definition" id="rfc.xref.header.field.definition.1" title="Header Field Definition">Section 4</a>), but it does not define special handling of these invalid field values. |
|---|
| 471 | </p> |
|---|
| 472 | <p id="rfc.section.3.p.3">Senders <em class="bcp14">MUST NOT</em> generate Content-Disposition header fields that are invalid. |
|---|
| 473 | </p> |
|---|
| 474 | <p id="rfc.section.3.p.4">Recipients <em class="bcp14">MAY</em> take steps to recover a usable field value from an invalid header field, but <em class="bcp14">SHOULD NOT</em> reject the message outright, unless this is explicitly desirable behavior (e.g., the implementation is a validator). As such, |
|---|
| 475 | the default handling of invalid fields is to ignore them. |
|---|
| 476 | </p> |
|---|
| 477 | <div id="rfc.iref.h.1"></div> |
|---|
| 478 | <div id="rfc.iref.c.1"></div> |
|---|
| 479 | <h1 id="rfc.section.4"><a href="#rfc.section.4">4.</a> <a id="header.field.definition" href="#header.field.definition">Header Field Definition</a></h1> |
|---|
| 480 | <p id="rfc.section.4.p.1">The Content-Disposition response header field is used to convey additional information about how to process the response payload, |
|---|
| 481 | and also can be used to attach additional metadata, such as the filename to use when saving the response payload locally. |
|---|
| 482 | </p> |
|---|
| 483 | <h2 id="rfc.section.4.1"><a href="#rfc.section.4.1">4.1</a> Grammar |
|---|
| 484 | </h2> |
|---|
| 485 | <div id="rfc.figure.u.1"></div><pre class="inline"> content-disposition = "Content-Disposition" ":" |
|---|
| 486 | disposition-type *( ";" disposition-parm ) |
|---|
| 487 | |
|---|
| 488 | disposition-type = "inline" | "attachment" | disp-ext-type |
|---|
| 489 | ; case-insensitive |
|---|
| 490 | disp-ext-type = token |
|---|
| 491 | |
|---|
| 492 | disposition-parm = filename-parm | disp-ext-parm |
|---|
| 493 | |
|---|
| 494 | filename-parm = "filename" "=" value |
|---|
| 495 | | "filename*" "=" ext-value |
|---|
| 496 | |
|---|
| 497 | disp-ext-parm = token "=" value |
|---|
| 498 | | ext-token "=" ext-value |
|---|
| 499 | ext-token = <the characters in token, followed by "*"> |
|---|
| 500 | </pre><div id="rfc.figure.u.2"></div> |
|---|
| 501 | <p>Defined in <a href="#RFC2616" id="rfc.xref.RFC2616.4"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>: |
|---|
| 502 | </p> <pre class="inline"> token = <token, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.5"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>> |
|---|
| 503 | quoted-string = <quoted-string, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.6"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>> |
|---|
| 504 | value = <value, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.7"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-3.6">Section 3.6</a>> |
|---|
| 505 | ; token | quoted-string |
|---|
| 506 | |
|---|
| 507 | </pre><div id="rfc.figure.u.3"></div> |
|---|
| 508 | <p>Defined in <a href="#RFC5987" id="rfc.xref.RFC5987.1"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>: |
|---|
| 509 | </p> <pre class="inline"> ext-value = <ext-value, defined in <a href="#RFC5987" id="rfc.xref.RFC5987.2"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, <a href="http://tools.ietf.org/html/rfc5987#section-3.2">Section 3.2</a>> |
|---|
| 510 | </pre><p id="rfc.section.4.1.p.4">Content-Disposition header field values with multiple instances of the same parameter name are invalid.</p> |
|---|
| 511 | <p id="rfc.section.4.1.p.5">Note that due to the rules for implied linear whitespace (<a href="http://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.8"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), <em class="bcp14">OPTIONAL</em> whitespace can appear between words (token or quoted-string) and separator characters. |
|---|
| 512 | </p> |
|---|
| 513 | <p id="rfc.section.4.1.p.6">Furthermore, note that the format used for ext-value allows specifying a natural language (e.g., "en"); this is of limited |
|---|
| 514 | use for filenames and is likely to be ignored by recipients. |
|---|
| 515 | </p> |
|---|
| 516 | <h2 id="rfc.section.4.2"><a href="#rfc.section.4.2">4.2</a> <a id="disposition.type" href="#disposition.type">Disposition Type</a></h2> |
|---|
| 517 | <p id="rfc.section.4.2.p.1">If the disposition type matches "attachment" (case-insensitively), this indicates that the recipient should prompt the user |
|---|
| 518 | to save the response locally, rather than process it normally (as per its media type). |
|---|
| 519 | </p> |
|---|
| 520 | <p id="rfc.section.4.2.p.2">On the other hand, if it matches "inline" (case-insensitively), this implies default processing. Therefore, the disposition |
|---|
| 521 | type "inline" is only useful when it is augmented with additional parameters, such as the filename (see below). |
|---|
| 522 | </p> |
|---|
| 523 | <p id="rfc.section.4.2.p.3">Unknown or unhandled disposition types <em class="bcp14">SHOULD</em> be handled by recipients the same way as "attachment" (see also <a href="#RFC2183" id="rfc.xref.RFC2183.2"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). |
|---|
| 524 | </p> |
|---|
| 525 | <h2 id="rfc.section.4.3"><a href="#rfc.section.4.3">4.3</a> <a id="disposition.parameter.filename" href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></h2> |
|---|
| 526 | <p id="rfc.section.4.3.p.1">The parameters "filename" and "filename*", to be matched case-insensitively, provide information on how to construct a filename |
|---|
| 527 | for storing the message payload. |
|---|
| 528 | </p> |
|---|
| 529 | <p id="rfc.section.4.3.p.2">Depending on the disposition type, this information might be used right away (in the "save as..." interaction caused for the |
|---|
| 530 | "attachment" disposition type), or later on (for instance, when the user decides to save the contents of the current page |
|---|
| 531 | being displayed). |
|---|
| 532 | </p> |
|---|
| 533 | <p id="rfc.section.4.3.p.3">The parameters "filename" and "filename*" differ only in that "filename*" uses the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.3"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allowing the use of characters not present in the ISO-8859-1 character set (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.1"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>). |
|---|
| 534 | </p> |
|---|
| 535 | <p id="rfc.section.4.3.p.4">Many user agent implementations predating this specification do not understand the "filename*" parameter. Therefore, when |
|---|
| 536 | both "filename" and "filename*" are present in a single header field value, recipients <em class="bcp14">SHOULD</em> pick "filename*" and ignore "filename". This way, senders can avoid special-casing specific user agents by sending both the |
|---|
| 537 | more expressive "filename*" parameter, and the "filename" parameter as fallback for legacy recipients (see <a href="#examples" title="Examples">Section 5</a> for an example). |
|---|
| 538 | </p> |
|---|
| 539 | <p id="rfc.section.4.3.p.5">It is essential that recipients treat the specified filename as advisory only, and thus be very careful in extracting the |
|---|
| 540 | desired information. In particular: |
|---|
| 541 | </p> |
|---|
| 542 | <ul> |
|---|
| 543 | <li> |
|---|
| 544 | <p>Recipients <em class="bcp14">MUST NOT</em> be able to write into any location other than one to which they are specifically entitled. To illustrate the problem, consider |
|---|
| 545 | the consequences of being able to overwrite well-known system locations (such as "/etc/passwd"). One strategy to achieve this |
|---|
| 546 | is to never trust folder name information in the filename parameter, for instance by stripping all but the last path segment |
|---|
| 547 | and only considering the actual filename (where 'path segments' are the components of the field value delimited by the path |
|---|
| 548 | separator characters "\" and "/"). |
|---|
| 549 | </p> |
|---|
| 550 | </li> |
|---|
| 551 | <li> |
|---|
| 552 | <p>Many platforms do not use Internet Media Types (<a href="#RFC2046" id="rfc.xref.RFC2046.1"><cite title="Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types">[RFC2046]</cite></a>) to hold type information in the file system, but rely on filename extensions instead. Trusting the server-provided file |
|---|
| 553 | extension could introduce a privilege escalation when the saved file is later opened (consider ".exe"). Thus, recipients that |
|---|
| 554 | make use of file extensions to determine the media type <em class="bcp14">MUST</em> ensure that a file extension is used that is safe, optimally matching the media type of the received payload. |
|---|
| 555 | </p> |
|---|
| 556 | </li> |
|---|
| 557 | <li> |
|---|
| 558 | <p>Recipients <em class="bcp14">SHOULD</em> strip or replace character sequences that are known to cause confusion both in user interfaces and in filenames, such as control |
|---|
| 559 | characters and leading and trailing whitespace. |
|---|
| 560 | </p> |
|---|
| 561 | </li> |
|---|
| 562 | <li> |
|---|
| 563 | <p>Other aspects recipients need to be aware of are names that have a special meaning in the file system or in shell commands, |
|---|
| 564 | such as "." and "..", "~", "|", and also device names. Recipients <em class="bcp14">SHOULD</em> ignore or substitute names like these. |
|---|
| 565 | </p> |
|---|
| 566 | </li> |
|---|
| 567 | </ul> |
|---|
| 568 | <div class="note" id="rfc.section.4.3.p.6"> |
|---|
| 569 | <p> <b>Note:</b> Many user agents do not properly handle the escape character "\" when using the quoted-string form. Furthermore, some user |
|---|
| 570 | agents erroneously try to perform unescaping of "percent" escapes (see <a href="#alternatives.percent" title="Percent Encoding">Appendix C.2</a>), and thus might misinterpret filenames containing the percent character followed by two hex digits. |
|---|
| 571 | </p> |
|---|
| 572 | </div> |
|---|
| 573 | <h2 id="rfc.section.4.4"><a href="#rfc.section.4.4">4.4</a> <a id="disposition.parameter.extensions" href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></h2> |
|---|
| 574 | <p id="rfc.section.4.4.p.1">To enable future extensions, recipients <em class="bcp14">SHOULD</em> ignore unrecognized parameters (see also <a href="#RFC2183" id="rfc.xref.RFC2183.3"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). |
|---|
| 575 | </p> |
|---|
| 576 | <h2 id="rfc.section.4.5"><a href="#rfc.section.4.5">4.5</a> <a id="extensibility" href="#extensibility">Extensibility</a></h2> |
|---|
| 577 | <p id="rfc.section.4.5.p.1">Note that <a href="http://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.4"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines IANA registries both for disposition types and disposition parameters. This registry is shared by different protocols |
|---|
| 578 | using Content-Disposition, such as MIME and HTTP. Therefore, not all registered values may make sense in the context of HTTP. |
|---|
| 579 | </p> |
|---|
| 580 | <h1 id="rfc.section.5"><a href="#rfc.section.5">5.</a> <a id="examples" href="#examples">Examples</a></h1> |
|---|
| 581 | <div id="rfc.figure.u.4"></div> |
|---|
| 582 | <p>Direct the UA to show "save as" dialog, with a filename of "example.html":</p> <pre class="text">Content-Disposition: Attachment; filename=example.html |
|---|
| 583 | </pre><div id="rfc.figure.u.5"></div> |
|---|
| 584 | <p>Direct the UA to behave as if the Content-Disposition header field wasn't present, but to remember the filename "an example.html" |
|---|
| 585 | for a subsequent save operation: |
|---|
| 586 | </p> <pre class="text">Content-Disposition: INLINE; FILENAME= "an example.html" |
|---|
| 587 | </pre> <p>Note: This uses the quoted-string form so that the space character can be included.</p> |
|---|
| 588 | <div id="rfc.figure.u.6"></div> |
|---|
| 589 | <p>Direct the UA to show "save as" dialog, with a filename containing the Unicode character U+20AC (EURO SIGN):</p> <pre class="text">Content-Disposition: attachment; |
|---|
| 590 | filename*= UTF-8''<b>%e2%82%ac</b>%20rates |
|---|
| 591 | </pre> <p>Here, the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.4"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> is also used to encode the non-ISO-8859-1 character. |
|---|
| 592 | </p> |
|---|
| 593 | <div id="rfc.figure.u.7"></div> |
|---|
| 594 | <p>This example is the same as the one above, but adding the "filename" parameter for compatibility with user agents not implementing |
|---|
| 595 | RFC 5987: |
|---|
| 596 | </p> <pre class="text">Content-Disposition: attachment; |
|---|
| 597 | filename="EURO rates"; |
|---|
| 598 | filename*=utf-8''<b>%e2%82%ac</b>%20rates |
|---|
| 599 | </pre> <p>Note: Those user agents that do not support the RFC 5987 encoding ignore "filename*" when it occurs after "filename".</p> |
|---|
| 600 | <h1 id="rfc.section.6"><a href="#rfc.section.6">6.</a> <a id="i18n" href="#i18n">Internationalization Considerations</a></h1> |
|---|
| 601 | <p id="rfc.section.6.p.1">The "filename*" parameter (<a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>), using the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.5"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allows the server to transmit characters outside the ISO-8859-1 character set, and also to optionally specify the language |
|---|
| 602 | in use. |
|---|
| 603 | </p> |
|---|
| 604 | <p id="rfc.section.6.p.2">Future parameters might also require internationalization, in which case the same encoding can be used.</p> |
|---|
| 605 | <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a> <a id="security.considerations" href="#security.considerations">Security Considerations</a></h1> |
|---|
| 606 | <p id="rfc.section.7.p.1">Using server-supplied information for constructing local filenames introduces many risks. These are summarized in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>. |
|---|
| 607 | </p> |
|---|
| 608 | <p id="rfc.section.7.p.2">Furthermore, implementers ought to be aware of the security considerations applying to HTTP (see <a href="http://tools.ietf.org/html/rfc2616#section-15">Section 15</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.9"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), and also the parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.6"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> (see <a href="http://tools.ietf.org/html/rfc5987#section-5" id="rfc.xref.RFC5987.7">Section 5</a>). |
|---|
| 609 | </p> |
|---|
| 610 | <h1 id="rfc.section.8"><a href="#rfc.section.8">8.</a> <a id="iana.considerations" href="#iana.considerations">IANA Considerations</a></h1> |
|---|
| 611 | <h2 id="rfc.section.8.1"><a href="#rfc.section.8.1">8.1</a> <a id="registry" href="#registry">Registry for Disposition Values and Parameters</a></h2> |
|---|
| 612 | <p id="rfc.section.8.1.p.1">This specification does not introduce any changes to the registration procedures for disposition values and parameters that |
|---|
| 613 | are defined in <a href="http://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.5"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>. |
|---|
| 614 | </p> |
|---|
| 615 | <h2 id="rfc.section.8.2"><a href="#rfc.section.8.2">8.2</a> <a id="header.field.registration" href="#header.field.registration">Header Field Registration</a></h2> |
|---|
| 616 | <p id="rfc.section.8.2.p.1">This document updates the definition of the Content-Disposition HTTP header field in the permanent HTTP header field registry |
|---|
| 617 | (see <a href="#RFC3864" id="rfc.xref.RFC3864.1"><cite title="Registration Procedures for Message Header Fields">[RFC3864]</cite></a>). |
|---|
| 618 | </p> |
|---|
| 619 | <p id="rfc.section.8.2.p.2"> </p> |
|---|
| 620 | <dl> |
|---|
| 621 | <dt>Header field name:</dt> |
|---|
| 622 | <dd>Content-Disposition</dd> |
|---|
| 623 | <dt>Applicable protocol:</dt> |
|---|
| 624 | <dd>http</dd> |
|---|
| 625 | <dt>Status:</dt> |
|---|
| 626 | <dd>standard</dd> |
|---|
| 627 | <dt>Author/Change controller:</dt> |
|---|
| 628 | <dd>IETF</dd> |
|---|
| 629 | <dt>Specification document:</dt> |
|---|
| 630 | <dd>this specification (<a href="#header.field.definition" id="rfc.xref.header.field.definition.2" title="Header Field Definition">Section 4</a>) |
|---|
| 631 | </dd> |
|---|
| 632 | <dt>Related information:</dt> |
|---|
| 633 | <dd>none</dd> |
|---|
| 634 | </dl> |
|---|
| 635 | <h1 id="rfc.section.9"><a href="#rfc.section.9">9.</a> Acknowledgements |
|---|
| 636 | </h1> |
|---|
| 637 | <p id="rfc.section.9.p.1">Thanks to Adam Barth, Rolf Eike Beer, Stewart Bryant, Bjoern Hoehrmann, Alfred Hoenes, Roar Lauritzsen, Alexey Melnikov, Henrik |
|---|
| 638 | Nordstrom, and Mark Nottingham for their valuable feedback. |
|---|
| 639 | </p> |
|---|
| 640 | <h1 id="rfc.references"><a id="rfc.section.10" href="#rfc.section.10">10.</a> References |
|---|
| 641 | </h1> |
|---|
| 642 | <h2 id="rfc.references.1"><a href="#rfc.section.10.1" id="rfc.section.10.1">10.1</a> Normative References |
|---|
| 643 | </h2> |
|---|
| 644 | <table> |
|---|
| 645 | <tr> |
|---|
| 646 | <td class="reference"><b id="ISO-8859-1">[ISO-8859-1]</b></td> |
|---|
| 647 | <td class="top">International Organization for Standardization, “Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1”, ISO/IEC 8859-1:1998, 1998.</td> |
|---|
| 648 | </tr> |
|---|
| 649 | <tr> |
|---|
| 650 | <td class="reference"><b id="RFC2119">[RFC2119]</b></td> |
|---|
| 651 | <td class="top"><a href="mailto:sob@harvard.edu" title="Harvard University">Bradner, S.</a>, “<a href="http://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>”, BCP 14, RFC 2119, March 1997. |
|---|
| 652 | </td> |
|---|
| 653 | </tr> |
|---|
| 654 | <tr> |
|---|
| 655 | <td class="reference"><b id="RFC2616">[RFC2616]</b></td> |
|---|
| 656 | <td class="top"><a href="mailto:fielding@ics.uci.edu" title="University of California, Irvine">Fielding, R.</a>, <a href="mailto:jg@w3.org" title="W3C">Gettys, J.</a>, <a href="mailto:mogul@wrl.dec.com" title="Compaq Computer Corporation">Mogul, J.</a>, <a href="mailto:frystyk@w3.org" title="MIT Laboratory for Computer Science">Frystyk, H.</a>, <a href="mailto:masinter@parc.xerox.com" title="Xerox Corporation">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, and <a href="mailto:timbl@w3.org" title="W3C">T. Berners-Lee</a>, “<a href="http://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>”, RFC 2616, June 1999. |
|---|
| 657 | </td> |
|---|
| 658 | </tr> |
|---|
| 659 | <tr> |
|---|
| 660 | <td class="reference"><b id="RFC5987">[RFC5987]</b></td> |
|---|
| 661 | <td class="top"><a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">Reschke, J.</a>, “<a href="http://tools.ietf.org/html/rfc5987">Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters</a>”, RFC 5987, August 2010. |
|---|
| 662 | </td> |
|---|
| 663 | </tr> |
|---|
| 664 | </table> |
|---|
| 665 | <h2 id="rfc.references.2"><a href="#rfc.section.10.2" id="rfc.section.10.2">10.2</a> Informative References |
|---|
| 666 | </h2> |
|---|
| 667 | <table> |
|---|
| 668 | <tr> |
|---|
| 669 | <td class="reference"><b id="RFC2046">[RFC2046]</b></td> |
|---|
| 670 | <td class="top"><a href="mailto:ned@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:nsb@nsb.fv.com" title="First Virtual Holdings">N. Borenstein</a>, “<a href="http://tools.ietf.org/html/rfc2046">Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types</a>”, RFC 2046, November 1996. |
|---|
| 671 | </td> |
|---|
| 672 | </tr> |
|---|
| 673 | <tr> |
|---|
| 674 | <td class="reference"><b id="RFC2047">[RFC2047]</b></td> |
|---|
| 675 | <td class="top"><a href="mailto:moore@cs.utk.edu" title="University of Tennessee">Moore, K.</a>, “<a href="http://tools.ietf.org/html/rfc2047">MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text</a>”, RFC 2047, November 1996. |
|---|
| 676 | </td> |
|---|
| 677 | </tr> |
|---|
| 678 | <tr> |
|---|
| 679 | <td class="reference"><b id="RFC2183">[RFC2183]</b></td> |
|---|
| 680 | <td class="top"><a href="mailto:rens@century.com" title="New Century Systems">Troost, R.</a>, <a href="mailto:sdorner@qualcomm.com" title="QUALCOMM Incorporated">Dorner, S.</a>, and <a href="mailto:moore@cs.utk.edu" title="Department of Computer Science">K. Moore, Ed.</a>, “<a href="http://tools.ietf.org/html/rfc2183">Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field</a>”, RFC 2183, August 1997. |
|---|
| 681 | </td> |
|---|
| 682 | </tr> |
|---|
| 683 | <tr> |
|---|
| 684 | <td class="reference"><b id="RFC2231">[RFC2231]</b></td> |
|---|
| 685 | <td class="top"><a href="mailto:ned.freed@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:moore@cs.utk.edu" title="University of Tennessee">K. Moore</a>, “<a href="http://tools.ietf.org/html/rfc2231">MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations</a>”, RFC 2231, November 1997. |
|---|
| 686 | </td> |
|---|
| 687 | </tr> |
|---|
| 688 | <tr> |
|---|
| 689 | <td class="reference"><b id="RFC2388">[RFC2388]</b></td> |
|---|
| 690 | <td class="top"><a href="mailto:masinter@parc.xerox.com" title="Xerox Palo Alto Research Center">Masinter, L.</a>, “<a href="http://tools.ietf.org/html/rfc2388">Returning Values from Forms: multipart/form-data</a>”, RFC 2388, August 1998. |
|---|
| 691 | </td> |
|---|
| 692 | </tr> |
|---|
| 693 | <tr> |
|---|
| 694 | <td class="reference"><b id="RFC3864">[RFC3864]</b></td> |
|---|
| 695 | <td class="top"><a href="mailto:GK-IETF@ninebynine.org" title="Nine by Nine">Klyne, G.</a>, <a href="mailto:mnot@pobox.com" title="BEA Systems">Nottingham, M.</a>, and <a href="mailto:JeffMogul@acm.org" title="HP Labs">J. Mogul</a>, “<a href="http://tools.ietf.org/html/rfc3864">Registration Procedures for Message Header Fields</a>”, BCP 90, RFC 3864, September 2004. |
|---|
| 696 | </td> |
|---|
| 697 | </tr> |
|---|
| 698 | <tr> |
|---|
| 699 | <td class="reference"><b id="RFC3986">[RFC3986]</b></td> |
|---|
| 700 | <td class="top"><a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:fielding@gbiv.com" title="Day Software">Fielding, R.</a>, and <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">L. Masinter</a>, “<a href="http://tools.ietf.org/html/rfc3986">Uniform Resource Identifier (URI): Generic Syntax</a>”, STD 66, RFC 3986, January 2005. |
|---|
| 701 | </td> |
|---|
| 702 | </tr> |
|---|
| 703 | <tr> |
|---|
| 704 | <td class="reference"><b id="US-ASCII">[US-ASCII]</b></td> |
|---|
| 705 | <td class="top">American National Standards Institute, “Coded Character Set -- 7-bit American Standard Code for Information Interchange”, ANSI X3.4, 1986.</td> |
|---|
| 706 | </tr> |
|---|
| 707 | </table> |
|---|
| 708 | <div class="avoidbreak"> |
|---|
| 709 | <h1 id="rfc.authors"><a href="#rfc.authors">Author's Address</a></h1> |
|---|
| 710 | <address class="vcard"><span class="vcardline"><span class="fn">Julian F. Reschke</span><span class="n hidden"><span class="family-name">Reschke</span><span class="given-name">Julian F.</span></span></span><span class="org vcardline">greenbytes GmbH</span><span class="adr"><span class="street-address vcardline">Hafenweg 16</span><span class="vcardline"><span class="locality">Muenster</span>, <span class="region">NW</span> <span class="postal-code">48155</span></span><span class="country-name vcardline">Germany</span></span><span class="vcardline">Email: <a href="mailto:julian.reschke@greenbytes.de"><span class="email">julian.reschke@greenbytes.de</span></a></span><span class="vcardline">URI: <a href="http://greenbytes.de/tech/webdav/" class="url">http://greenbytes.de/tech/webdav/</a></span></address> |
|---|
| 711 | </div> |
|---|
| 712 | <h1 id="rfc.section.A" class="np"><a href="#rfc.section.A">A.</a> <a id="changes.from.rfc2616" href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></h1> |
|---|
| 713 | <p id="rfc.section.A.p.1">Compared to <a href="http://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.10"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, the following normative changes reflecting actual implementations have been made: |
|---|
| 714 | </p> |
|---|
| 715 | <ul> |
|---|
| 716 | <li>According to RFC 2616, the disposition type "attachment" only applies to content of type "application/octet-stream". This |
|---|
| 717 | restriction has been removed, because recipients in practice do not check the content type, and it also discourages properly |
|---|
| 718 | declaring the media type. |
|---|
| 719 | </li> |
|---|
| 720 | <li>RFC 2616 only allows "quoted-string" for the filename parameter. This would be an exceptional parameter syntax, and also doesn't |
|---|
| 721 | reflect actual use. |
|---|
| 722 | </li> |
|---|
| 723 | <li>The definition for the disposition type "inline" (<a href="#RFC2183" id="rfc.xref.RFC2183.6"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.1">Section 2.1</a>) has been re-added with a suggestion for its processing. |
|---|
| 724 | </li> |
|---|
| 725 | <li>This specification requires support for the extended parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.8"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>. |
|---|
| 726 | </li> |
|---|
| 727 | </ul> |
|---|
| 728 | <h1 id="rfc.section.B"><a href="#rfc.section.B">B.</a> <a id="diffs.compared.to.rfc2183" href="#diffs.compared.to.rfc2183">Differences Compared to RFC 2183</a></h1> |
|---|
| 729 | <p id="rfc.section.B.p.1"> <a href="http://tools.ietf.org/html/rfc2183#section-2">Section 2</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.7"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines several additional disposition parameters: "creation-date", "modification-date", "quoted-date-time", and "size". The |
|---|
| 730 | majority of user agents do not implement these; thus, they have been omitted from this specification. |
|---|
| 731 | </p> |
|---|
| 732 | <h1 id="rfc.section.C"><a href="#rfc.section.C">C.</a> <a id="alternatives" href="#alternatives">Alternative Approaches to Internationalization</a></h1> |
|---|
| 733 | <p id="rfc.section.C.p.1">By default, HTTP header field parameters cannot carry characters outside the ISO-8859-1 (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.2"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>) character encoding (see <a href="#RFC2616" id="rfc.xref.RFC2616.11"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>). For the "filename" parameter, this of course is an unacceptable restriction. |
|---|
| 734 | </p> |
|---|
| 735 | <p id="rfc.section.C.p.2">Unfortunately, user agent implementers have not managed to come up with an interoperable approach, although the IETF Standards |
|---|
| 736 | Track specifies exactly one solution (<a href="#RFC2231" id="rfc.xref.RFC2231.1"><cite title="MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations">[RFC2231]</cite></a>, clarified and profiled for HTTP in <a href="#RFC5987" id="rfc.xref.RFC5987.9"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>). |
|---|
| 737 | </p> |
|---|
| 738 | <p id="rfc.section.C.p.3">For completeness, the sections below describe the various approaches that have been tried, and explain how they are inferior |
|---|
| 739 | to the RFC 5987 encoding used in this specification. |
|---|
| 740 | </p> |
|---|
| 741 | <h2 id="rfc.section.C.1"><a href="#rfc.section.C.1">C.1</a> <a id="alternatives.rfc2047" href="#alternatives.rfc2047">RFC 2047 Encoding</a></h2> |
|---|
| 742 | <p id="rfc.section.C.1.p.1">RFC 2047 defines an encoding mechanism for header fields, but this encoding is not supposed to be used for header field parameters |
|---|
| 743 | — see <a href="http://tools.ietf.org/html/rfc2047#section-5">Section 5</a> of <a href="#RFC2047" id="rfc.xref.RFC2047.1"><cite title="MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text">[RFC2047]</cite></a>: |
|---|
| 744 | </p> |
|---|
| 745 | <blockquote id="rfc.section.C.1.p.2" cite="http://tools.ietf.org/html/rfc2047#section-5"> |
|---|
| 746 | <p>An 'encoded-word' MUST NOT appear within a 'quoted-string'.</p> |
|---|
| 747 | <p>...</p> |
|---|
| 748 | <p>An 'encoded-word' MUST NOT be used in parameter of a MIME Content-Type or Content-Disposition field, or in any structured |
|---|
| 749 | field body except within a 'comment' or 'phrase'. |
|---|
| 750 | </p> |
|---|
| 751 | </blockquote> |
|---|
| 752 | <p id="rfc.section.C.1.p.3">In practice, some user agents implement the encoding, some do not (exposing the encoded string to the user), and some get |
|---|
| 753 | confused by it. |
|---|
| 754 | </p> |
|---|
| 755 | <h2 id="rfc.section.C.2"><a href="#rfc.section.C.2">C.2</a> <a id="alternatives.percent" href="#alternatives.percent">Percent Encoding</a></h2> |
|---|
| 756 | <p id="rfc.section.C.2.p.1">Some user agents accept percent-encoded (<a href="#RFC3986" id="rfc.xref.RFC3986.1"><cite title="Uniform Resource Identifier (URI): Generic Syntax">[RFC3986]</cite></a>, <a href="http://tools.ietf.org/html/rfc3986#section-2.1">Section 2.1</a>) sequences of characters. The character encoding being used for decoding depends on various factors, including the encoding |
|---|
| 757 | of the referring page, the user agent's locale, its configuration, and also the actual value of the parameter. |
|---|
| 758 | </p> |
|---|
| 759 | <p id="rfc.section.C.2.p.2">In practice, this is hard to use because those user agents that do not support it will display the escaped character sequence |
|---|
| 760 | to the user. For those user agents that do implement this, it is difficult to predict what character encoding they actually |
|---|
| 761 | expect. |
|---|
| 762 | </p> |
|---|
| 763 | <h2 id="rfc.section.C.3"><a href="#rfc.section.C.3">C.3</a> <a id="alternatives.sniff" href="#alternatives.sniff">Encoding Sniffing</a></h2> |
|---|
| 764 | <p id="rfc.section.C.3.p.1">Some user agents inspect the value (which defaults to ISO-8859-1 for the quoted-string form) and switch to UTF-8 when it seems |
|---|
| 765 | to be more likely to be the correct interpretation. |
|---|
| 766 | </p> |
|---|
| 767 | <p id="rfc.section.C.3.p.2">As with the approaches above, this is not interoperable and, furthermore, risks misinterpreting the actual value.</p> |
|---|
| 768 | <h1 id="rfc.section.D"><a href="#rfc.section.D">D.</a> <a id="advice.generating" href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></h1> |
|---|
| 769 | <p id="rfc.section.D.p.1">To successfully interoperate with existing and future user agents, senders of the Content-Disposition header field are advised |
|---|
| 770 | to: |
|---|
| 771 | </p> |
|---|
| 772 | <p id="rfc.section.D.p.2"> </p> |
|---|
| 773 | <ul> |
|---|
| 774 | <li>Include a "filename" parameter when US-ASCII (<a href="#US-ASCII" id="rfc.xref.US-ASCII.1"><cite title="Coded Character Set -- 7-bit American Standard Code for Information Interchange">[US-ASCII]</cite></a>) is sufficiently expressive. |
|---|
| 775 | </li> |
|---|
| 776 | <li>Use the 'token' form of the filename parameter only when it does not contain disallowed characters (e.g., spaces); in such |
|---|
| 777 | cases, the quoted-string form should be used. |
|---|
| 778 | </li> |
|---|
| 779 | <li>Avoid including the percent character followed by two hexadecimal characters (e.g., %A9) in the filename parameter, since |
|---|
| 780 | some existing implementations consider it to be an escape character, while others will pass it through unchanged. |
|---|
| 781 | </li> |
|---|
| 782 | <li>Avoid including the "\" character in the quoted-string form of the filename parameter, as escaping is not implemented by some |
|---|
| 783 | user agents, and "\" can be considered an illegal path character. |
|---|
| 784 | </li> |
|---|
| 785 | <li>Avoid using non-ASCII characters in the filename parameter. Although most existing implementations will decode them as ISO‑8859‑1, |
|---|
| 786 | some will apply heuristics to detect UTF-8, and thus might fail on certain names. |
|---|
| 787 | </li> |
|---|
| 788 | <li>Include a "filename*" parameter where the desired filename cannot be expressed faithfully using the "filename" form. Note |
|---|
| 789 | that legacy user agents will not process this, and will fall back to using the "filename" parameter's content. |
|---|
| 790 | </li> |
|---|
| 791 | <li>When a "filename*" parameter is sent, to also generate a "filename" parameter as a fallback for user agents that do not support |
|---|
| 792 | the "filename*" form, if possible. This can be done by substituting characters with US-ASCII sequences (e.g., Unicode character |
|---|
| 793 | point U+00E4 (LATIN SMALL LETTER A WITH DIARESIS) by "ae"). Note that this may not be possible in some locales. |
|---|
| 794 | </li> |
|---|
| 795 | <li>When a "filename" parameter is included as a fallback (as per above), "filename" should occur first, due to parsing problems |
|---|
| 796 | in some existing implementations. |
|---|
| 797 | </li> |
|---|
| 798 | <li>Use UTF-8 as the encoding of the "filename*" parameter, when present, because at least one existing implementation only implements |
|---|
| 799 | that encoding. |
|---|
| 800 | </li> |
|---|
| 801 | </ul> |
|---|
| 802 | <p id="rfc.section.D.p.3">Note that this advice is based upon UA behavior at the time of writing, and might be superseded. At the time of publication |
|---|
| 803 | of this document, <<a href="http://purl.org/NET/http/content-disposition-tests">http://purl.org/NET/http/content-disposition-tests</a>> provides an overview of current levels of support in various implementations. |
|---|
| 804 | </p> |
|---|
| 805 | </body> |
|---|
| 806 | </html> |
|---|
![(please configure the [header_logo] section in trac.ini)](https://www.ietf.org/images/ietflogotrans.gif)
