- Timestamp:
- 14/06/14 11:20:37 (8 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
draft-ietf-httpbis-content-disp/06/draft-ietf-httpbis-content-disp.html
r1144 r2726 2 2 PUBLIC "-//W3C//DTD HTML 4.01//EN"> 3 3 <html lang="en"> 4 <head profile="http:// www.w3.org/2006/03/hcard http://dublincore.org/documents/2008/08/04/dc-html/">4 <head profile="http://dublincore.org/documents/2008/08/04/dc-html/"> 5 5 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> 6 6 <title>Use of the Content-Disposition Header Field … … 33 33 body { 34 34 color: black; 35 font-family: verdana, helvetica, arial, sans-serif; 36 font-size: 10pt; 35 font-family: cambria, helvetica, arial, sans-serif; 36 font-size: 11pt; 37 margin-right: 2em; 37 38 } 38 39 cite { … … 42 43 margin-left: 2em; 43 44 } 44 dd {45 margin-right: 2em;46 }47 45 dl { 48 46 margin-left: 2em; 49 47 } 50 51 48 ul.empty { 52 49 list-style-type: none; … … 62 59 } 63 60 h1 { 64 font-size: 1 4pt;61 font-size: 130%; 65 62 line-height: 21pt; 66 63 page-break-after: avoid; … … 69 66 page-break-before: always; 70 67 } 71 h1 a {72 color: #333333;73 }74 68 h2 { 75 font-size: 12 pt;69 font-size: 120%; 76 70 line-height: 15pt; 77 71 page-break-after: avoid; 78 72 } 79 h3 , h4, h5, h6{80 font-size: 1 0pt;73 h3 { 74 font-size: 110%; 81 75 page-break-after: avoid; 82 76 } 83 h2 a, h3 a, h4 a, h5 a, h6 a { 77 h4, h5, h6 { 78 page-break-after: avoid; 79 } 80 h1 a, h2 a, h3 a, h4 a, h5 a, h6 a { 84 81 color: black; 85 82 } … … 89 86 li { 90 87 margin-left: 2em; 91 margin-right: 2em;92 88 } 93 89 ol { 94 90 margin-left: 2em; 95 margin-right: 2em; 91 } 92 ol.la { 93 list-style-type: lower-alpha; 94 } 95 ol.ua { 96 list-style-type: upper-alpha; 96 97 } 97 98 ol p { … … 100 101 p { 101 102 margin-left: 2em; 102 margin-right: 2em;103 103 } 104 104 pre { … … 106 106 background-color: lightyellow; 107 107 padding: .25em; 108 page-break-inside: avoid; 108 109 } 109 110 pre.text2 { … … 134 135 table.tt { 135 136 vertical-align: top; 137 border-color: gray; 138 } 139 table.tt th { 140 border-color: gray; 141 } 142 table.tt td { 143 border-color: gray; 144 } 145 table.all { 146 border-style: solid; 147 border-width: 2px; 136 148 } 137 149 table.full { 138 border-style: outset; 139 border-width: 1px; 140 } 141 table.headers { 142 border-style: outset; 143 border-width: 1px; 150 border-style: solid; 151 border-width: 2px; 144 152 } 145 153 table.tt td { 146 154 vertical-align: top; 147 155 } 156 table.all td { 157 border-style: solid; 158 border-width: 1px; 159 } 148 160 table.full td { 149 border-style: inset;161 border-style: none solid; 150 162 border-width: 1px; 151 163 } … … 153 165 vertical-align: top; 154 166 } 167 table.all th { 168 border-style: solid; 169 border-width: 1px; 170 } 155 171 table.full th { 156 border-style: inset;157 border-width: 1px ;172 border-style: solid; 173 border-width: 1px 1px 2px 1px; 158 174 } 159 175 table.headers th { 160 border-style: none none insetnone;161 border-width: 1px;176 border-style: none none solid none; 177 border-width: 2px; 162 178 } 163 179 table.left { … … 174 190 caption-side: bottom; 175 191 font-weight: bold; 176 font-size: 9pt;192 font-size: 10pt; 177 193 margin-top: .5em; 178 194 } … … 181 197 border-spacing: 1px; 182 198 width: 95%; 183 font-size: 1 0pt;199 font-size: 11pt; 184 200 color: white; 185 201 } … … 189 205 td.topnowrap { 190 206 vertical-align: top; 191 white-space: nowrap; 207 white-space: nowrap; 192 208 } 193 209 table.header td { … … 209 225 list-style: none; 210 226 margin-left: 1.5em; 211 margin-right: 0em;212 227 padding-left: 0em; 213 228 } … … 215 230 line-height: 150%; 216 231 font-weight: bold; 217 font-size: 10pt;218 232 margin-left: 0em; 219 margin-right: 0em;220 233 } 221 234 ul.toc li li { 222 235 line-height: normal; 223 236 font-weight: normal; 224 font-size: 9pt;237 font-size: 10pt; 225 238 margin-left: 0em; 226 margin-right: 0em;227 239 } 228 240 li.excluded { … … 231 243 ul p { 232 244 margin-left: 0em; 245 } 246 .title, .filename, h1, h2, h3, h4 { 247 font-family: candara, helvetica, arial, sans-serif; 248 } 249 samp, tt, code, pre { 250 font: consolas, monospace; 233 251 } 234 252 ul.ind, ul.ind ul { 235 253 list-style: none; 236 254 margin-left: 1.5em; 237 margin-right: 0em;238 255 padding-left: 0em; 239 256 page-break-before: avoid; … … 243 260 line-height: 200%; 244 261 margin-left: 0em; 245 margin-right: 0em;246 262 } 247 263 ul.ind li li { … … 249 265 line-height: 150%; 250 266 margin-left: 0em; 251 margin-right: 0em;252 267 } 253 268 .avoidbreak { … … 276 291 font-weight: bold; 277 292 text-align: center; 278 font-size: 9pt;293 font-size: 10pt; 279 294 } 280 295 .filename { 281 296 color: #333333; 297 font-size: 75%; 282 298 font-weight: bold; 283 font-size: 12pt;284 299 line-height: 21pt; 285 300 text-align: center; … … 288 303 font-weight: bold; 289 304 } 290 .hidden {291 display: none;292 }293 305 .left { 294 306 text-align: left; … … 298 310 } 299 311 .title { 300 color: #990000;301 font-size: 1 8pt;312 color: green; 313 font-size: 150%; 302 314 line-height: 18pt; 303 315 font-weight: bold; … … 305 317 margin-top: 36pt; 306 318 } 307 .vcardline {308 display: block;309 }310 319 .warning { 311 font-size: 1 4pt;320 font-size: 130%; 312 321 background-color: yellow; 313 322 } … … 318 327 display: none; 319 328 } 320 329 321 330 a { 322 331 color: black; … … 333 342 background-color: white; 334 343 vertical-align: top; 335 font-size: 1 2pt;336 } 337 338 ul.toc a: :after {344 font-size: 110%; 345 } 346 347 ul.toc a:nth-child(2)::after { 339 348 content: leader('.') target-counter(attr(href), page); 340 349 } 341 350 342 351 ul.ind li li a { 343 352 content: target-counter(attr(href), page); 344 353 } 345 354 346 355 .print2col { 347 356 column-count: 2; … … 353 362 @page { 354 363 @top-left { 355 content: "Internet-Draft"; 356 } 364 content: "Internet-Draft"; 365 } 357 366 @top-right { 358 content: "February 2011"; 359 } 367 content: "February 2011"; 368 } 360 369 @top-center { 361 content: "Content-Disposition in HTTP"; 362 } 370 content: "Content-Disposition in HTTP"; 371 } 363 372 @bottom-left { 364 content: "Reschke"; 365 } 373 content: "Reschke"; 374 } 366 375 @bottom-center { 367 content: "Expires August 30, 2011"; 368 } 376 content: "Expires August 30, 2011"; 377 } 369 378 @bottom-right { 370 content: "[Page " counter(page) "]"; 371 } 372 } 373 374 @page:first { 379 content: "[Page " counter(page) "]"; 380 } 381 } 382 383 @page:first { 375 384 @top-left { 376 385 content: normal; … … 402 411 <link rel="Appendix" title="D Advice on Generating Content-Disposition Header Fields" href="#rfc.section.D"> 403 412 <link rel="Appendix" title="E Change Log (to be removed by RFC Editor before publication)" href="#rfc.section.E"> 404 <meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1. 540, 2011-01-10 09:27:20, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/">413 <meta name="generator" content="http://greenbytes.de/tech/webdav/rfc2629.xslt, Revision 1.640, 2014/06/13 12:42:58, XSLT vendor: SAXON 8.9 from Saxonica http://www.saxonica.com/"> 405 414 <link rel="schema.dct" href="http://purl.org/dc/terms/"> 406 415 <meta name="dct.creator" content="Reschke, J. F."> … … 422 431 </tr> 423 432 <tr> 424 <td class="left">Updates: <a href="http ://tools.ietf.org/html/rfc2616">2616</a> (if approved)433 <td class="left">Updates: <a href="https://tools.ietf.org/html/rfc2616">2616</a> (if approved) 425 434 </td> 426 435 <td class="right">February 26, 2011</td> … … 437 446 </table> 438 447 <p class="title">Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)<br><span class="filename">draft-ietf-httpbis-content-disp-06</span></p> 439 <h1 id="rfc.abstract"><a href="#rfc.abstract">Abstract</a></h1> 448 <h1 id="rfc.abstract"><a href="#rfc.abstract">Abstract</a></h1> 440 449 <p>RFC 2616 defines the Content-Disposition response header field, but points out that it is not part of the HTTP/1.1 Standard. 441 450 This specification takes over the definition and registration of Content-Disposition, as used in HTTP, and clarifies internationalization 442 451 aspects. 443 </p> 444 <h1 id="rfc.note.1"><a href="#rfc.note.1">Editorial Note (To be removed by RFC Editor before publication)</a></h1> 452 </p> 453 <h1 id="rfc.note.1"><a href="#rfc.note.1">Editorial Note (To be removed by RFC Editor before publication)</a></h1> 445 454 <p>This specification is expected to replace the definition of Content-Disposition in the HTTP/1.1 specification, as currently 446 455 revised by the IETF HTTPbis working group. See also <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/ticket/123">http://trac.tools.ietf.org/wg/httpbis/trac/ticket/123</a>>. 447 </p> 456 </p> 448 457 <p>Discussion of this draft should take place on the HTTPBIS working group mailing list (ietf-http-wg@w3.org). The current issues 449 458 list is at <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/query?component=content-disp">http://trac.tools.ietf.org/wg/httpbis/trac/query?component=content-disp</a>> and related documents (including fancy diffs) can be found at <<a href="http://tools.ietf.org/wg/httpbis/">http://tools.ietf.org/wg/httpbis/</a>>. 450 </p> 459 </p> 451 460 <p>The changes in this draft are summarized in <a href="#changes.since.05" title="Since draft-ietf-httpbis-content-disp-05">Appendix E.10</a>. 452 </p>453 <h1><a id="rfc.status" href="#rfc.status">Status of This Memo</a></h1>454 <p>This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.</p>455 <p>Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute456 working documents as Internet-Drafts. The list of current Internet-Drafts is at <a href="http://datatracker.ietf.org/drafts/current/">http://datatracker.ietf.org/drafts/current/</a>.457 461 </p> 458 <p>Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other 459 documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work 460 in progress”. 461 </p> 462 <p>This Internet-Draft will expire on August 30, 2011.</p> 463 <h1><a id="rfc.copyrightnotice" href="#rfc.copyrightnotice">Copyright Notice</a></h1> 464 <p>Copyright © 2011 IETF Trust and the persons identified as the document authors. All rights reserved.</p> 465 <p>This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights 466 and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License 467 text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified 468 BSD License. 469 </p> 462 <div id="rfc.status"> 463 <h1><a href="#rfc.status">Status of This Memo</a></h1> 464 <p>This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.</p> 465 <p>Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute 466 working documents as Internet-Drafts. The list of current Internet-Drafts is at <a href="http://datatracker.ietf.org/drafts/current/">http://datatracker.ietf.org/drafts/current/</a>. 467 </p> 468 <p>Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other 469 documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work 470 in progress”. 471 </p> 472 <p>This Internet-Draft will expire on August 30, 2011.</p> 473 </div> 474 <div id="rfc.copyrightnotice"> 475 <h1><a href="#rfc.copyrightnotice">Copyright Notice</a></h1> 476 <p>Copyright © 2011 IETF Trust and the persons identified as the document authors. All rights reserved.</p> 477 <p>This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights 478 and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License 479 text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified 480 BSD License. 481 </p> 482 </div> 470 483 <hr class="noprint"> 471 484 <h1 class="np" id="rfc.toc"><a href="#rfc.toc">Table of Contents</a></h1> 472 485 <ul class="toc"> 473 <li> 1. <a href="#introduction">Introduction</a></li>474 <li> 2. <a href="#notational.conventions">Notational Conventions</a></li>475 <li> 3. <a href="#conformance.and.error.handling">Conformance and Error Handling</a></li>476 <li> 4. <a href="#header.field.definition">Header Field Definition</a><ul>477 <li> 4.1 <a href="#rfc.section.4.1">Grammar</a></li>478 <li> 4.2 <a href="#disposition.type">Disposition Type</a></li>479 <li> 4.3 <a href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></li>480 <li> 4.4 <a href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></li>481 <li> 4.5 <a href="#extensibility">Extensibility</a></li>486 <li><a href="#rfc.section.1">1.</a> <a href="#introduction">Introduction</a></li> 487 <li><a href="#rfc.section.2">2.</a> <a href="#notational.conventions">Notational Conventions</a></li> 488 <li><a href="#rfc.section.3">3.</a> <a href="#conformance.and.error.handling">Conformance and Error Handling</a></li> 489 <li><a href="#rfc.section.4">4.</a> <a href="#header.field.definition">Header Field Definition</a><ul> 490 <li><a href="#rfc.section.4.1">4.1</a> <a href="#rfc.section.4.1">Grammar</a></li> 491 <li><a href="#rfc.section.4.2">4.2</a> <a href="#disposition.type">Disposition Type</a></li> 492 <li><a href="#rfc.section.4.3">4.3</a> <a href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></li> 493 <li><a href="#rfc.section.4.4">4.4</a> <a href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></li> 494 <li><a href="#rfc.section.4.5">4.5</a> <a href="#extensibility">Extensibility</a></li> 482 495 </ul> 483 496 </li> 484 <li> 5. <a href="#examples">Examples</a></li>485 <li> 6. <a href="#i18n">Internationalization Considerations</a></li>486 <li> 7. <a href="#security.considerations">Security Considerations</a></li>487 <li> 8. <a href="#iana.considerations">IANA Considerations</a><ul>488 <li> 8.1 <a href="#registry">Registry for Disposition Values and Parameter</a></li>489 <li> 8.2 <a href="#header.field.registration">Header Field Registration</a></li>497 <li><a href="#rfc.section.5">5.</a> <a href="#examples">Examples</a></li> 498 <li><a href="#rfc.section.6">6.</a> <a href="#i18n">Internationalization Considerations</a></li> 499 <li><a href="#rfc.section.7">7.</a> <a href="#security.considerations">Security Considerations</a></li> 500 <li><a href="#rfc.section.8">8.</a> <a href="#iana.considerations">IANA Considerations</a><ul> 501 <li><a href="#rfc.section.8.1">8.1</a> <a href="#registry">Registry for Disposition Values and Parameter</a></li> 502 <li><a href="#rfc.section.8.2">8.2</a> <a href="#header.field.registration">Header Field Registration</a></li> 490 503 </ul> 491 504 </li> 492 <li> 9. <a href="#rfc.section.9">Acknowledgements</a></li>493 <li> 10. <a href="#rfc.references">References</a><ul>494 <li> 10.1 <a href="#rfc.references.1">Normative References</a></li>495 <li> 10.2 <a href="#rfc.references.2">Informative References</a></li>505 <li><a href="#rfc.section.9">9.</a> <a href="#rfc.section.9">Acknowledgements</a></li> 506 <li><a href="#rfc.section.10">10.</a> <a href="#rfc.references">References</a><ul> 507 <li><a href="#rfc.section.10.1">10.1</a> <a href="#rfc.references.1">Normative References</a></li> 508 <li><a href="#rfc.section.10.2">10.2</a> <a href="#rfc.references.2">Informative References</a></li> 496 509 </ul> 497 510 </li> 498 <li><a href="#rfc.authors">Author's Address</a></li> 499 <li>A. <a href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></li> 500 <li>B. <a href="#diffs.compared.to.rfc2183">Differences compared to RFC 2183</a></li> 501 <li>C. <a href="#alternatives">Alternative Approaches to Internationalization</a><ul> 502 <li>C.1 <a href="#alternatives.rfc2047">RFC 2047 Encoding</a></li> 503 <li>C.2 <a href="#alternatives.percent">Percent Encoding</a></li> 504 <li>C.3 <a href="#alternatives.sniff">Encoding Sniffing</a></li> 505 <li>C.4 <a href="#alternatives.implementations">Implementations (to be removed by RFC Editor before publication)</a></li> 511 <li><a href="#rfc.section.A">A.</a> <a href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></li> 512 <li><a href="#rfc.section.B">B.</a> <a href="#diffs.compared.to.rfc2183">Differences compared to RFC 2183</a></li> 513 <li><a href="#rfc.section.C">C.</a> <a href="#alternatives">Alternative Approaches to Internationalization</a><ul> 514 <li><a href="#rfc.section.C.1">C.1</a> <a href="#alternatives.rfc2047">RFC 2047 Encoding</a></li> 515 <li><a href="#rfc.section.C.2">C.2</a> <a href="#alternatives.percent">Percent Encoding</a></li> 516 <li><a href="#rfc.section.C.3">C.3</a> <a href="#alternatives.sniff">Encoding Sniffing</a></li> 517 <li><a href="#rfc.section.C.4">C.4</a> <a href="#alternatives.implementations">Implementations (to be removed by RFC Editor before publication)</a></li> 506 518 </ul> 507 519 </li> 508 <li> D. <a href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></li>509 <li> E. <a href="#change.log">Change Log (to be removed by RFC Editor before publication)</a><ul>510 <li> E.1 <a href="#rfc.section.E.1">Since draft-reschke-rfc2183-in-http-00</a></li>511 <li> E.2 <a href="#rfc.section.E.2">Since draft-reschke-rfc2183-in-http-01</a></li>512 <li> E.3 <a href="#rfc.section.E.3">Since draft-reschke-rfc2183-in-http-02</a></li>513 <li> E.4 <a href="#rfc.section.E.4">Since draft-reschke-rfc2183-in-http-03</a></li>514 <li> E.5 <a href="#changes.since.00">Since draft-ietf-httpbis-content-disp-00</a></li>515 <li> E.6 <a href="#changes.since.01">Since draft-ietf-httpbis-content-disp-01</a></li>516 <li> E.7 <a href="#changes.since.02">Since draft-ietf-httpbis-content-disp-02</a></li>517 <li> E.8 <a href="#changes.since.03">Since draft-ietf-httpbis-content-disp-03</a></li>518 <li> E.9 <a href="#changes.since.04">Since draft-ietf-httpbis-content-disp-04</a></li>519 <li> E.10 <a href="#changes.since.05">Since draft-ietf-httpbis-content-disp-05</a></li>520 <li><a href="#rfc.section.D">D.</a> <a href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></li> 521 <li><a href="#rfc.section.E">E.</a> <a href="#change.log">Change Log (to be removed by RFC Editor before publication)</a><ul> 522 <li><a href="#rfc.section.E.1">E.1</a> <a href="#rfc.section.E.1">Since draft-reschke-rfc2183-in-http-00</a></li> 523 <li><a href="#rfc.section.E.2">E.2</a> <a href="#rfc.section.E.2">Since draft-reschke-rfc2183-in-http-01</a></li> 524 <li><a href="#rfc.section.E.3">E.3</a> <a href="#rfc.section.E.3">Since draft-reschke-rfc2183-in-http-02</a></li> 525 <li><a href="#rfc.section.E.4">E.4</a> <a href="#rfc.section.E.4">Since draft-reschke-rfc2183-in-http-03</a></li> 526 <li><a href="#rfc.section.E.5">E.5</a> <a href="#changes.since.00">Since draft-ietf-httpbis-content-disp-00</a></li> 527 <li><a href="#rfc.section.E.6">E.6</a> <a href="#changes.since.01">Since draft-ietf-httpbis-content-disp-01</a></li> 528 <li><a href="#rfc.section.E.7">E.7</a> <a href="#changes.since.02">Since draft-ietf-httpbis-content-disp-02</a></li> 529 <li><a href="#rfc.section.E.8">E.8</a> <a href="#changes.since.03">Since draft-ietf-httpbis-content-disp-03</a></li> 530 <li><a href="#rfc.section.E.9">E.9</a> <a href="#changes.since.04">Since draft-ietf-httpbis-content-disp-04</a></li> 531 <li><a href="#rfc.section.E.10">E.10</a> <a href="#changes.since.05">Since draft-ietf-httpbis-content-disp-05</a></li> 520 532 </ul> 521 533 </li> 522 534 <li><a href="#rfc.index">Index</a></li> 535 <li><a href="#rfc.authors">Author's Address</a></li> 523 536 </ul> 524 <h1 id="rfc.section.1" class="np"><a href="#rfc.section.1">1.</a> <a id="introduction" href="#introduction">Introduction</a></h1> 525 <p id="rfc.section.1.p.1">RFC 2616 defines the Content-Disposition response header field in <a href="http://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.1"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, but points out that it is not part of the HTTP/1.1 Standard (<a href="http://tools.ietf.org/html/rfc2616#section-15.5" id="rfc.xref.RFC2616.2">Section 15.5</a>): 526 </p> 527 <blockquote id="rfc.section.1.p.2" cite="http://tools.ietf.org/html/rfc2616#section-15.5"> 528 <p>Content-Disposition is not part of the HTTP standard, but since it is widely implemented, we are documenting its use and risks 529 for implementers. 530 </p> 531 </blockquote> 532 <p id="rfc.section.1.p.3">This specification takes over the definition and registration of Content-Disposition, as used in HTTP. Based on interoperability 533 testing with existing User Agents, it fully defines a profile of the features defined in the Multipurpose Internet Mail Extensions 534 (MIME) variant (<a href="#RFC2183" id="rfc.xref.RFC2183.1"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>) of the header field, and also clarifies internationalization aspects. 535 </p> 536 <div class="note" id="rfc.section.1.p.4"> 537 <p> <b>Note:</b> this document does not apply to Content-Disposition header fields appearing in payload bodies transmitted over HTTP, such 538 as when using the media type "multipart/form-data" (<a href="#RFC2388" id="rfc.xref.RFC2388.1"><cite title="Returning Values from Forms: multipart/form-data">[RFC2388]</cite></a>). 539 </p> 540 </div> 541 <h1 id="rfc.section.2"><a href="#rfc.section.2">2.</a> <a id="notational.conventions" href="#notational.conventions">Notational Conventions</a></h1> 542 <p id="rfc.section.2.p.1">The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" 543 in this document are to be interpreted as described in <a href="#RFC2119" id="rfc.xref.RFC2119.1"><cite title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</cite></a>. 544 </p> 545 <p id="rfc.section.2.p.2">This specification uses the augmented BNF notation defined in <a href="http://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.3"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, including its rules for implied linear whitespace (LWS). 546 </p> 547 <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> <a id="conformance.and.error.handling" href="#conformance.and.error.handling">Conformance and Error Handling</a></h1> 548 <p id="rfc.section.3.p.1">This specification defines conformance criteria for both senders (usually, HTTP origin servers) and recipients (usually, HTTP 549 user agents) of the Content-Disposition header field. An implementation is considered conformant if it complies with all of 550 the requirements associated with its role. 551 </p> 552 <p id="rfc.section.3.p.2">This specification also defines certain forms of the header field-value to be invalid, using both ABNF and prose requirements, 553 but it does not define special handling of these invalid field-values. 554 </p> 555 <p id="rfc.section.3.p.3">Senders <em class="bcp14">MUST NOT</em> generate Content-Disposition header fields that are invalid. 556 </p> 557 <p id="rfc.section.3.p.4">Recipients <em class="bcp14">MAY</em> take steps to recover a usable field-value from an invalid header field, but <em class="bcp14">SHOULD NOT</em> reject the message outright, unless this is explicitly desirable behaviour (e.g., the implementation is a validator). As such, 558 the default handling of invalid fields is to ignore them. 559 </p> 560 <div id="rfc.iref.h.1"></div> 561 <div id="rfc.iref.c.1"></div> 562 <h1 id="rfc.section.4"><a href="#rfc.section.4">4.</a> <a id="header.field.definition" href="#header.field.definition">Header Field Definition</a></h1> 563 <p id="rfc.section.4.p.1">The Content-Disposition response header field is used to convey additional information about how to process the response payload, 564 and also can be used to attach additional metadata, such as the filename to use when saving the response payload locally. 565 </p> 566 <h2 id="rfc.section.4.1"><a href="#rfc.section.4.1">4.1</a> Grammar 567 </h2> 568 <div id="rfc.figure.u.1"></div><pre class="inline"> content-disposition = "Content-Disposition" ":" 537 <div id="introduction"> 538 <h1 id="rfc.section.1" class="np"><a href="#rfc.section.1">1.</a> <a href="#introduction">Introduction</a></h1> 539 <p id="rfc.section.1.p.1">RFC 2616 defines the Content-Disposition response header field in <a href="https://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.1"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, but points out that it is not part of the HTTP/1.1 Standard (<a href="https://tools.ietf.org/html/rfc2616#section-15.5" id="rfc.xref.RFC2616.2">Section 15.5</a>): 540 </p> 541 <blockquote id="rfc.section.1.p.2" cite="http://tools.ietf.org/html/rfc2616#section-15.5"> 542 <p>Content-Disposition is not part of the HTTP standard, but since it is widely implemented, we are documenting its use and risks 543 for implementers. 544 </p> 545 </blockquote> 546 <p id="rfc.section.1.p.3">This specification takes over the definition and registration of Content-Disposition, as used in HTTP. Based on interoperability 547 testing with existing User Agents, it fully defines a profile of the features defined in the Multipurpose Internet Mail Extensions 548 (MIME) variant (<a href="#RFC2183" id="rfc.xref.RFC2183.1"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>) of the header field, and also clarifies internationalization aspects. 549 </p> 550 <div class="note" id="rfc.section.1.p.4"> 551 <p><b>Note:</b> this document does not apply to Content-Disposition header fields appearing in payload bodies transmitted over HTTP, such 552 as when using the media type "multipart/form-data" (<a href="#RFC2388" id="rfc.xref.RFC2388.1"><cite title="Returning Values from Forms: multipart/form-data">[RFC2388]</cite></a>). 553 </p> 554 </div> 555 </div> 556 <div id="notational.conventions"> 557 <h1 id="rfc.section.2"><a href="#rfc.section.2">2.</a> <a href="#notational.conventions">Notational Conventions</a></h1> 558 <p id="rfc.section.2.p.1">The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" 559 in this document are to be interpreted as described in <a href="#RFC2119" id="rfc.xref.RFC2119.1"><cite title="Key words for use in RFCs to Indicate Requirement Levels">[RFC2119]</cite></a>. 560 </p> 561 <p id="rfc.section.2.p.2">This specification uses the augmented BNF notation defined in <a href="https://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.3"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, including its rules for implied linear whitespace (LWS). 562 </p> 563 </div> 564 <div id="conformance.and.error.handling"> 565 <h1 id="rfc.section.3"><a href="#rfc.section.3">3.</a> <a href="#conformance.and.error.handling">Conformance and Error Handling</a></h1> 566 <p id="rfc.section.3.p.1">This specification defines conformance criteria for both senders (usually, HTTP origin servers) and recipients (usually, HTTP 567 user agents) of the Content-Disposition header field. An implementation is considered conformant if it complies with all of 568 the requirements associated with its role. 569 </p> 570 <p id="rfc.section.3.p.2">This specification also defines certain forms of the header field-value to be invalid, using both ABNF and prose requirements, 571 but it does not define special handling of these invalid field-values. 572 </p> 573 <p id="rfc.section.3.p.3">Senders <em class="bcp14">MUST NOT</em> generate Content-Disposition header fields that are invalid. 574 </p> 575 <p id="rfc.section.3.p.4">Recipients <em class="bcp14">MAY</em> take steps to recover a usable field-value from an invalid header field, but <em class="bcp14">SHOULD NOT</em> reject the message outright, unless this is explicitly desirable behaviour (e.g., the implementation is a validator). As such, 576 the default handling of invalid fields is to ignore them. 577 </p> 578 </div> 579 <div id="header.field.definition"> 580 <div id="rfc.iref.h.1"></div> 581 <div id="rfc.iref.c.1"></div> 582 <h1 id="rfc.section.4"><a href="#rfc.section.4">4.</a> <a href="#header.field.definition">Header Field Definition</a></h1> 583 <p id="rfc.section.4.p.1">The Content-Disposition response header field is used to convey additional information about how to process the response payload, 584 and also can be used to attach additional metadata, such as the filename to use when saving the response payload locally. 585 </p> 586 <div> 587 <h2 id="rfc.section.4.1"><a href="#rfc.section.4.1">4.1</a> Grammar 588 </h2> 589 <div id="rfc.figure.u.1"></div><pre class="inline"> content-disposition = "Content-Disposition" ":" 569 590 disposition-type *( ";" disposition-parm ) 570 591 … … 581 602 | ext-token "=" ext-value 582 603 ext-token = <the characters in token, followed by "*"> 583 </pre><div id="rfc.figure.u.2"></div> 584 <p>Defined in <a href="#RFC2616" id="rfc.xref.RFC2616.4"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>:585 </p> <pre class="inline"> token = <token, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.5"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>>586 quoted-string = <quoted-string, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.6"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http ://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>>587 value = <value, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.7"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http ://tools.ietf.org/html/rfc2616#section-3.6">Section 3.6</a>>604 </pre><div id="rfc.figure.u.2"></div> 605 <p>Defined in <a href="#RFC2616" id="rfc.xref.RFC2616.4"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>: 606 </p><pre class="inline"> token = <token, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.5"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="https://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>> 607 quoted-string = <quoted-string, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.6"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="https://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>> 608 value = <value, defined in <a href="#RFC2616" id="rfc.xref.RFC2616.7"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="https://tools.ietf.org/html/rfc2616#section-3.6">Section 3.6</a>> 588 609 ; token | quoted-string 589 610 590 </pre><div id="rfc.figure.u.3"></div> 591 <p>Defined in <a href="#RFC5987" id="rfc.xref.RFC5987.1"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>:592 </p> <pre class="inline"> ext-value = <ext-value, defined in <a href="#RFC5987" id="rfc.xref.RFC5987.2"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, <a href="http://tools.ietf.org/html/rfc5987#section-3.2">Section 3.2</a>>611 </pre><div id="rfc.figure.u.3"></div> 612 <p>Defined in <a href="#RFC5987" id="rfc.xref.RFC5987.1"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>: 613 </p><pre class="inline"> ext-value = <ext-value, defined in <a href="#RFC5987" id="rfc.xref.RFC5987.2"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, <a href="https://tools.ietf.org/html/rfc5987#section-3.2">Section 3.2</a>> 593 614 </pre><p id="rfc.section.4.1.p.4">Header field values with multiple instances of the same parameter name are invalid.</p> 594 <p id="rfc.section.4.1.p.5">Note that due to the rules for implied linear whitespace (<a href="http://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.8"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), <em class="bcp14">OPTIONAL</em> whitespace can appear between words (token or quoted-string) and separator characters. 595 </p> 596 <p id="rfc.section.4.1.p.6">Furthermore note that the format used for ext-value allows specifying a natural language; this is of limited use for filenames 597 and is likely to be ignored by recipients. 598 </p> 599 <h2 id="rfc.section.4.2"><a href="#rfc.section.4.2">4.2</a> <a id="disposition.type" href="#disposition.type">Disposition Type</a></h2> 600 <p id="rfc.section.4.2.p.1">If the disposition type matches "attachment" (case-insensitively), this indicates that the recipient should prompt the user 601 to save the response locally, rather than process it normally (as per its media type). 602 </p> 603 <p id="rfc.section.4.2.p.2">On the other hand, if it matches "inline" (case-insensitively), this implies default processing. Therefore, the disposition 604 type "inline" is only useful when it is augmented with additional parameters, such as the filename (see below). 605 </p> 606 <p id="rfc.section.4.2.p.3">Unknown or unhandled disposition types <em class="bcp14">SHOULD</em> be handled by recipients the same way as "attachment" (see also <a href="#RFC2183" id="rfc.xref.RFC2183.2"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). 607 </p> 608 <h2 id="rfc.section.4.3"><a href="#rfc.section.4.3">4.3</a> <a id="disposition.parameter.filename" href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></h2> 609 <p id="rfc.section.4.3.p.1">The parameters "filename" and "filename*", to be matched case-insensitively, provide information on how to construct a filename 610 for storing the message payload. 611 </p> 612 <p id="rfc.section.4.3.p.2">Depending on the disposition type, this information might be used right away (in the "save as..." interaction caused for the 613 "attachment" disposition type), or later on (for instance, when the user decides to save the contents of the current page 614 being displayed). 615 </p> 616 <p id="rfc.section.4.3.p.3">The parameters "filename" and "filename*" differ only in that "filename*" uses the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.3"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allowing the use of characters not present in the ISO-8859-1 character set (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.1"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>). 617 </p> 618 <p id="rfc.section.4.3.p.4">Many user agent implementations predating this specification do not understand the "filename*" parameter. Therefore, when 619 both "filename" and "filename*" are present in a single header field value, recipients <em class="bcp14">SHOULD</em> pick "filename*" and ignore "filename". This way, senders can avoid special-casing specific user agents by sending both the 620 more expressive "filename*" parameter, and the "filename" parameter as fallback for legacy recipients (see <a href="#examples" title="Examples">Section 5</a> for an example). 621 </p> 622 <p id="rfc.section.4.3.p.5">It is essential that recipients treat the specified filename as advisory only, thus be very careful in extracting the desired 623 information. In particular: 624 </p> 625 <ul> 626 <li> 627 <p>When the value contains path separator characters ("\" or "/"), recipients <em class="bcp14">SHOULD</em> ignore all but the last path segment. This prevents unintentional overwriting of well-known file system locations (such as 628 "/etc/passwd"). 629 </p> 630 </li> 631 <li> 632 <p>Many platforms do not use Internet Media Types (<a href="#RFC2046" id="rfc.xref.RFC2046.1"><cite title="Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types">[RFC2046]</cite></a>) to hold type information in the file system, but rely on filename extensions instead. Trusting the server-provided file 633 extension could introduce a privilege escalation when the saved file is later opened (consider ".exe"). Thus, recipients need 634 to ensure that a file extension is used that is safe, optimally matching the media type of the received payload. 635 </p> 636 </li> 637 <li> 638 <p>Recipients are advised to strip or replace character sequences that are known to cause confusion both in user interfaces and 639 in filenames, such as control characters and leading and trailing whitespace. 640 </p> 641 </li> 642 <li> 643 <p>Other aspects recipients need to be aware of are names that have a special meaning in the file system or in shell commands, 644 such as "." and "..", "~", "|", and also device names. 645 </p> 646 </li> 647 </ul> 648 <div class="note" id="rfc.section.4.3.p.6"> 649 <p> <b>Note:</b> Many user agents do not properly handle the escape character "\" when using the quoted-string form. Furthermore, some user 650 agents erroneously try to perform unescaping of "percent" escapes (see <a href="#alternatives.percent" title="Percent Encoding">Appendix C.2</a>), and thus might misinterpret filenames containing the percent character followed by two hex digits. 651 </p> 652 </div> 653 <h2 id="rfc.section.4.4"><a href="#rfc.section.4.4">4.4</a> <a id="disposition.parameter.extensions" href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></h2> 654 <p id="rfc.section.4.4.p.1">To enable future extensions, recipients <em class="bcp14">SHOULD</em> ignore unrecognized parameters (see also <a href="#RFC2183" id="rfc.xref.RFC2183.3"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). 655 </p> 656 <h2 id="rfc.section.4.5"><a href="#rfc.section.4.5">4.5</a> <a id="extensibility" href="#extensibility">Extensibility</a></h2> 657 <p id="rfc.section.4.5.p.1">Note that <a href="http://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.4"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines IANA registries both for disposition types and disposition parameters. This registry is shared by different protocols 658 using Content-Disposition, such as MIME and HTTP. Therefore, not all registered values may make sense in the context of HTTP. 659 </p> 660 <h1 id="rfc.section.5"><a href="#rfc.section.5">5.</a> <a id="examples" href="#examples">Examples</a></h1> 661 <div id="rfc.figure.u.4"></div> 662 <p>Direct UA to show "save as" dialog, with a filename of "example.html":</p> <pre class="text">Content-Disposition: Attachment; filename=example.html 663 </pre><div id="rfc.figure.u.5"></div> 664 <p>Direct UA to behave as if the Content-Disposition header field wasn't present, but to remember the filename "an example.html" 665 for a subsequent save operation: 666 </p> <pre class="text">Content-Disposition: INLINE; FILENAME= "an example.html" 667 </pre> <p>Note: this uses the quoted-string form so that the space character can be included.</p> 668 <div id="rfc.figure.u.6"></div> 669 <p>Direct UA to show "save as" dialog, with a filename containing the Unicode character U+20AC (EURO SIGN):</p> <pre class="text">Content-Disposition: attachment; 615 <p id="rfc.section.4.1.p.5">Note that due to the rules for implied linear whitespace (<a href="https://tools.ietf.org/html/rfc2616#section-2.1">Section 2.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.8"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), <em class="bcp14">OPTIONAL</em> whitespace can appear between words (token or quoted-string) and separator characters. 616 </p> 617 <p id="rfc.section.4.1.p.6">Furthermore note that the format used for ext-value allows specifying a natural language; this is of limited use for filenames 618 and is likely to be ignored by recipients. 619 </p> 620 </div> 621 <div id="disposition.type"> 622 <h2 id="rfc.section.4.2"><a href="#rfc.section.4.2">4.2</a> <a href="#disposition.type">Disposition Type</a></h2> 623 <p id="rfc.section.4.2.p.1">If the disposition type matches "attachment" (case-insensitively), this indicates that the recipient should prompt the user 624 to save the response locally, rather than process it normally (as per its media type). 625 </p> 626 <p id="rfc.section.4.2.p.2">On the other hand, if it matches "inline" (case-insensitively), this implies default processing. Therefore, the disposition 627 type "inline" is only useful when it is augmented with additional parameters, such as the filename (see below). 628 </p> 629 <p id="rfc.section.4.2.p.3">Unknown or unhandled disposition types <em class="bcp14">SHOULD</em> be handled by recipients the same way as "attachment" (see also <a href="#RFC2183" id="rfc.xref.RFC2183.2"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="https://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). 630 </p> 631 </div> 632 <div id="disposition.parameter.filename"> 633 <h2 id="rfc.section.4.3"><a href="#rfc.section.4.3">4.3</a> <a href="#disposition.parameter.filename">Disposition Parameter: 'Filename'</a></h2> 634 <p id="rfc.section.4.3.p.1">The parameters "filename" and "filename*", to be matched case-insensitively, provide information on how to construct a filename 635 for storing the message payload. 636 </p> 637 <p id="rfc.section.4.3.p.2">Depending on the disposition type, this information might be used right away (in the "save as..." interaction caused for the 638 "attachment" disposition type), or later on (for instance, when the user decides to save the contents of the current page 639 being displayed). 640 </p> 641 <p id="rfc.section.4.3.p.3">The parameters "filename" and "filename*" differ only in that "filename*" uses the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.3"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allowing the use of characters not present in the ISO-8859-1 character set (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.1"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>). 642 </p> 643 <p id="rfc.section.4.3.p.4">Many user agent implementations predating this specification do not understand the "filename*" parameter. Therefore, when 644 both "filename" and "filename*" are present in a single header field value, recipients <em class="bcp14">SHOULD</em> pick "filename*" and ignore "filename". This way, senders can avoid special-casing specific user agents by sending both the 645 more expressive "filename*" parameter, and the "filename" parameter as fallback for legacy recipients (see <a href="#examples" title="Examples">Section 5</a> for an example). 646 </p> 647 <p id="rfc.section.4.3.p.5">It is essential that recipients treat the specified filename as advisory only, thus be very careful in extracting the desired 648 information. In particular: 649 </p> 650 <ul> 651 <li> 652 <p>When the value contains path separator characters ("\" or "/"), recipients <em class="bcp14">SHOULD</em> ignore all but the last path segment. This prevents unintentional overwriting of well-known file system locations (such as 653 "/etc/passwd"). 654 </p> 655 </li> 656 <li> 657 <p>Many platforms do not use Internet Media Types (<a href="#RFC2046" id="rfc.xref.RFC2046.1"><cite title="Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types">[RFC2046]</cite></a>) to hold type information in the file system, but rely on filename extensions instead. Trusting the server-provided file 658 extension could introduce a privilege escalation when the saved file is later opened (consider ".exe"). Thus, recipients need 659 to ensure that a file extension is used that is safe, optimally matching the media type of the received payload. 660 </p> 661 </li> 662 <li> 663 <p>Recipients are advised to strip or replace character sequences that are known to cause confusion both in user interfaces and 664 in filenames, such as control characters and leading and trailing whitespace. 665 </p> 666 </li> 667 <li> 668 <p>Other aspects recipients need to be aware of are names that have a special meaning in the file system or in shell commands, 669 such as "." and "..", "~", "|", and also device names. 670 </p> 671 </li> 672 </ul> 673 <div class="note" id="rfc.section.4.3.p.6"> 674 <p><b>Note:</b> Many user agents do not properly handle the escape character "\" when using the quoted-string form. Furthermore, some user 675 agents erroneously try to perform unescaping of "percent" escapes (see <a href="#alternatives.percent" title="Percent Encoding">Appendix C.2</a>), and thus might misinterpret filenames containing the percent character followed by two hex digits. 676 </p> 677 </div> 678 </div> 679 <div id="disposition.parameter.extensions"> 680 <h2 id="rfc.section.4.4"><a href="#rfc.section.4.4">4.4</a> <a href="#disposition.parameter.extensions">Disposition Parameter: Extensions</a></h2> 681 <p id="rfc.section.4.4.p.1">To enable future extensions, recipients <em class="bcp14">SHOULD</em> ignore unrecognized parameters (see also <a href="#RFC2183" id="rfc.xref.RFC2183.3"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="https://tools.ietf.org/html/rfc2183#section-2.8">Section 2.8</a>). 682 </p> 683 </div> 684 <div id="extensibility"> 685 <h2 id="rfc.section.4.5"><a href="#rfc.section.4.5">4.5</a> <a href="#extensibility">Extensibility</a></h2> 686 <p id="rfc.section.4.5.p.1">Note that <a href="https://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.4"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines IANA registries both for disposition types and disposition parameters. This registry is shared by different protocols 687 using Content-Disposition, such as MIME and HTTP. Therefore, not all registered values may make sense in the context of HTTP. 688 </p> 689 </div> 690 </div> 691 <div id="examples"> 692 <h1 id="rfc.section.5"><a href="#rfc.section.5">5.</a> <a href="#examples">Examples</a></h1> 693 <div id="rfc.figure.u.4"></div> 694 <p>Direct UA to show "save as" dialog, with a filename of "example.html":</p><pre class="text">Content-Disposition: Attachment; filename=example.html 695 </pre><div id="rfc.figure.u.5"></div> 696 <p>Direct UA to behave as if the Content-Disposition header field wasn't present, but to remember the filename "an example.html" 697 for a subsequent save operation: 698 </p><pre class="text">Content-Disposition: INLINE; FILENAME= "an example.html" 699 </pre><p>Note: this uses the quoted-string form so that the space character can be included.</p> 700 <div id="rfc.figure.u.6"></div> 701 <p>Direct UA to show "save as" dialog, with a filename containing the Unicode character U+20AC (EURO SIGN):</p><pre class="text">Content-Disposition: attachment; 670 702 filename*= UTF-8''<b>%e2%82%ac</b>%20rates 671 </pre> 672 </p>673 <div id="rfc.figure.u.7"></div>674 <p>Same as above, but adding the "filename" parameter for compatibility with user agents not implementing RFC 5987:</p><pre class="text">Content-Disposition: attachment;703 </pre><p>Here, the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.4"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> is also used to encode the non-ISO-8859-1 character. 704 </p> 705 <div id="rfc.figure.u.7"></div> 706 <p>Same as above, but adding the "filename" parameter for compatibility with user agents not implementing RFC 5987:</p><pre class="text">Content-Disposition: attachment; 675 707 filename="EURO rates"; 676 708 filename*=utf-8''<b>%e2%82%ac</b>%20rates 677 </pre> <p>Note: those user agents that do not support the RFC 5987 encoding ignore "filename*" when it occurs after "filename".</p> 678 <h1 id="rfc.section.6"><a href="#rfc.section.6">6.</a> <a id="i18n" href="#i18n">Internationalization Considerations</a></h1> 679 <p id="rfc.section.6.p.1">The "filename*" parameter (<a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>), using the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.5"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allows the server to transmit characters outside the ISO-8859-1 character set, and also to optionally specify the language 680 in use. 681 </p> 682 <p id="rfc.section.6.p.2">Future parameters might also require internationalization, in which case the same encoding can be used.</p> 683 <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a> <a id="security.considerations" href="#security.considerations">Security Considerations</a></h1> 684 <p id="rfc.section.7.p.1">Using server-supplied information for constructing local filenames introduces many risks. These are summarized in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>. 685 </p> 686 <p id="rfc.section.7.p.2">Furthermore, implementers also ought to be aware of the Security Considerations applying to HTTP (see <a href="http://tools.ietf.org/html/rfc2616#section-15">Section 15</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.9"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), and also the parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.6"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> (see <a href="http://tools.ietf.org/html/rfc5987#section-5" id="rfc.xref.RFC5987.7">Section 5</a>). 687 </p> 688 <h1 id="rfc.section.8"><a href="#rfc.section.8">8.</a> <a id="iana.considerations" href="#iana.considerations">IANA Considerations</a></h1> 689 <h2 id="rfc.section.8.1"><a href="#rfc.section.8.1">8.1</a> <a id="registry" href="#registry">Registry for Disposition Values and Parameter</a></h2> 690 <p id="rfc.section.8.1.p.1">This specification does not introduce any changes to the registration procedures for disposition values and parameters that 691 are defined in <a href="http://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.5"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>. 692 </p> 693 <h2 id="rfc.section.8.2"><a href="#rfc.section.8.2">8.2</a> <a id="header.field.registration" href="#header.field.registration">Header Field Registration</a></h2> 694 <p id="rfc.section.8.2.p.1">This document updates the definition of the Content-Disposition HTTP header field in the permanent HTTP header field registry 695 (see <a href="#RFC3864" id="rfc.xref.RFC3864.1"><cite title="Registration Procedures for Message Header Fields">[RFC3864]</cite></a>). 696 </p> 697 <p id="rfc.section.8.2.p.2"> </p> 698 <dl> 699 <dt>Header field name:</dt> 700 <dd>Content-Disposition</dd> 701 <dt>Applicable protocol:</dt> 702 <dd>http</dd> 703 <dt>Status:</dt> 704 <dd>standard</dd> 705 <dt>Author/Change controller:</dt> 706 <dd>IETF</dd> 707 <dt>Specification document:</dt> 708 <dd>this specification (<a href="#header.field.definition" id="rfc.xref.header.field.definition.1" title="Header Field Definition">Section 4</a>) 709 </dd> 710 </dl> 711 <h1 id="rfc.section.9"><a href="#rfc.section.9">9.</a> Acknowledgements 712 </h1> 713 <p id="rfc.section.9.p.1">Thanks to Adam Barth, Rolf Eike Beer, Bjoern Hoehrmann, Alfred Hoenes, Roar Lauritzsen, Henrik Nordstrom, and Mark Nottingham 714 for their valuable feedback. 715 </p> 709 </pre><p>Note: those user agents that do not support the RFC 5987 encoding ignore "filename*" when it occurs after "filename".</p> 710 </div> 711 <div id="i18n"> 712 <h1 id="rfc.section.6"><a href="#rfc.section.6">6.</a> <a href="#i18n">Internationalization Considerations</a></h1> 713 <p id="rfc.section.6.p.1">The "filename*" parameter (<a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>), using the encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.5"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>, allows the server to transmit characters outside the ISO-8859-1 character set, and also to optionally specify the language 714 in use. 715 </p> 716 <p id="rfc.section.6.p.2">Future parameters might also require internationalization, in which case the same encoding can be used.</p> 717 </div> 718 <div id="security.considerations"> 719 <h1 id="rfc.section.7"><a href="#rfc.section.7">7.</a> <a href="#security.considerations">Security Considerations</a></h1> 720 <p id="rfc.section.7.p.1">Using server-supplied information for constructing local filenames introduces many risks. These are summarized in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>. 721 </p> 722 <p id="rfc.section.7.p.2">Furthermore, implementers also ought to be aware of the Security Considerations applying to HTTP (see <a href="https://tools.ietf.org/html/rfc2616#section-15">Section 15</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.9"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>), and also the parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.6"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a> (see <a href="https://tools.ietf.org/html/rfc5987#section-5" id="rfc.xref.RFC5987.7">Section 5</a>). 723 </p> 724 </div> 725 <div id="iana.considerations"> 726 <h1 id="rfc.section.8"><a href="#rfc.section.8">8.</a> <a href="#iana.considerations">IANA Considerations</a></h1> 727 <div id="registry"> 728 <h2 id="rfc.section.8.1"><a href="#rfc.section.8.1">8.1</a> <a href="#registry">Registry for Disposition Values and Parameter</a></h2> 729 <p id="rfc.section.8.1.p.1">This specification does not introduce any changes to the registration procedures for disposition values and parameters that 730 are defined in <a href="https://tools.ietf.org/html/rfc2183#section-9">Section 9</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.5"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>. 731 </p> 732 </div> 733 <div id="header.field.registration"> 734 <h2 id="rfc.section.8.2"><a href="#rfc.section.8.2">8.2</a> <a href="#header.field.registration">Header Field Registration</a></h2> 735 <p id="rfc.section.8.2.p.1">This document updates the definition of the Content-Disposition HTTP header field in the permanent HTTP header field registry 736 (see <a href="#RFC3864" id="rfc.xref.RFC3864.1"><cite title="Registration Procedures for Message Header Fields">[RFC3864]</cite></a>). 737 </p> 738 <p id="rfc.section.8.2.p.2"></p> 739 <dl> 740 <dt>Header field name:</dt> 741 <dd>Content-Disposition</dd> 742 <dt>Applicable protocol:</dt> 743 <dd>http</dd> 744 <dt>Status:</dt> 745 <dd>standard</dd> 746 <dt>Author/Change controller:</dt> 747 <dd>IETF</dd> 748 <dt>Specification document:</dt> 749 <dd>this specification (<a href="#header.field.definition" id="rfc.xref.header.field.definition.1" title="Header Field Definition">Section 4</a>) 750 </dd> 751 </dl> 752 </div> 753 </div> 754 <div> 755 <h1 id="rfc.section.9"><a href="#rfc.section.9">9.</a> Acknowledgements 756 </h1> 757 <p id="rfc.section.9.p.1">Thanks to Adam Barth, Rolf Eike Beer, Bjoern Hoehrmann, Alfred Hoenes, Roar Lauritzsen, Henrik Nordstrom, and Mark Nottingham 758 for their valuable feedback. 759 </p> 760 </div> 716 761 <h1 id="rfc.references"><a id="rfc.section.10" href="#rfc.section.10">10.</a> References 717 762 </h1> 718 763 <h2 id="rfc.references.1"><a href="#rfc.section.10.1" id="rfc.section.10.1">10.1</a> Normative References 719 764 </h2> 720 <table> 765 <table> 721 766 <tr> 722 767 <td class="reference"><b id="ISO-8859-1">[ISO-8859-1]</b></td> … … 725 770 <tr> 726 771 <td class="reference"><b id="RFC2119">[RFC2119]</b></td> 727 <td class="top"><a href="mailto:sob@harvard.edu" title="Harvard University">Bradner, S.</a>, “<a href="http ://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>”, BCP 14, RFC 2119, March 1997.772 <td class="top"><a href="mailto:sob@harvard.edu" title="Harvard University">Bradner, S.</a>, “<a href="https://tools.ietf.org/html/rfc2119">Key words for use in RFCs to Indicate Requirement Levels</a>”, BCP 14, RFC 2119, March 1997. 728 773 </td> 729 774 </tr> 730 775 <tr> 731 776 <td class="reference"><b id="RFC2616">[RFC2616]</b></td> 732 <td class="top"><a href="mailto:fielding@ics.uci.edu" title="University of California, Irvine">Fielding, R.</a>, <a href="mailto:jg@w3.org" title="W3C">Gettys, J.</a>, <a href="mailto:mogul@wrl.dec.com" title="Compaq Computer Corporation">Mogul, J.</a>, <a href="mailto:frystyk@w3.org" title="MIT Laboratory for Computer Science">Frystyk, H.</a>, <a href="mailto:masinter@parc.xerox.com" title="Xerox Corporation">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, and <a href="mailto:timbl@w3.org" title="W3C">T. Berners-Lee</a>, “<a href="http ://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>”, RFC 2616, June 1999.777 <td class="top"><a href="mailto:fielding@ics.uci.edu" title="University of California, Irvine">Fielding, R.</a>, <a href="mailto:jg@w3.org" title="W3C">Gettys, J.</a>, <a href="mailto:mogul@wrl.dec.com" title="Compaq Computer Corporation">Mogul, J.</a>, <a href="mailto:frystyk@w3.org" title="MIT Laboratory for Computer Science">Frystyk, H.</a>, <a href="mailto:masinter@parc.xerox.com" title="Xerox Corporation">Masinter, L.</a>, <a href="mailto:paulle@microsoft.com" title="Microsoft Corporation">Leach, P.</a>, and <a href="mailto:timbl@w3.org" title="W3C">T. Berners-Lee</a>, “<a href="https://tools.ietf.org/html/rfc2616">Hypertext Transfer Protocol -- HTTP/1.1</a>”, RFC 2616, June 1999. 733 778 </td> 734 779 </tr> 735 780 <tr> 736 781 <td class="reference"><b id="RFC5987">[RFC5987]</b></td> 737 <td class="top"><a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">Reschke, J.</a>, “<a href="http ://tools.ietf.org/html/rfc5987">Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters</a>”, RFC 5987, August 2010.782 <td class="top"><a href="mailto:julian.reschke@greenbytes.de" title="greenbytes GmbH">Reschke, J.</a>, “<a href="https://tools.ietf.org/html/rfc5987">Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters</a>”, RFC 5987, August 2010. 738 783 </td> 739 784 </tr> … … 741 786 <h2 id="rfc.references.2"><a href="#rfc.section.10.2" id="rfc.section.10.2">10.2</a> Informative References 742 787 </h2> 743 <table> 788 <table> 744 789 <tr> 745 790 <td class="reference"><b id="RFC2046">[RFC2046]</b></td> 746 <td class="top"><a href="mailto:ned@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:nsb@nsb.fv.com" title="First Virtual Holdings">N. Borenstein</a>, “<a href="http ://tools.ietf.org/html/rfc2046">Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types</a>”, RFC 2046, November 1996.791 <td class="top"><a href="mailto:ned@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:nsb@nsb.fv.com" title="First Virtual Holdings">N. Borenstein</a>, “<a href="https://tools.ietf.org/html/rfc2046">Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types</a>”, RFC 2046, November 1996. 747 792 </td> 748 793 </tr> 749 794 <tr> 750 795 <td class="reference"><b id="RFC2047">[RFC2047]</b></td> 751 <td class="top"><a href="mailto:moore@cs.utk.edu" title="University of Tennessee">Moore, K.</a>, “<a href="http ://tools.ietf.org/html/rfc2047">MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text</a>”, RFC 2047, November 1996.796 <td class="top"><a href="mailto:moore@cs.utk.edu" title="University of Tennessee">Moore, K.</a>, “<a href="https://tools.ietf.org/html/rfc2047">MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text</a>”, RFC 2047, November 1996. 752 797 </td> 753 798 </tr> 754 799 <tr> 755 800 <td class="reference"><b id="RFC2183">[RFC2183]</b></td> 756 <td class="top"><a href="mailto:rens@century.com" title="New Century Systems">Troost, R.</a>, <a href="mailto:sdorner@qualcomm.com" title="QUALCOMM Incorporated">Dorner, S.</a>, and <a href="mailto:moore@cs.utk.edu" title="Department of Computer Science">K. Moore</a>, “<a href="http ://tools.ietf.org/html/rfc2183">Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field</a>”, RFC 2183, August 1997.801 <td class="top"><a href="mailto:rens@century.com" title="New Century Systems">Troost, R.</a>, <a href="mailto:sdorner@qualcomm.com" title="QUALCOMM Incorporated">Dorner, S.</a>, and <a href="mailto:moore@cs.utk.edu" title="Department of Computer Science">K. Moore</a>, “<a href="https://tools.ietf.org/html/rfc2183">Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field</a>”, RFC 2183, August 1997. 757 802 </td> 758 803 </tr> 759 804 <tr> 760 805 <td class="reference"><b id="RFC2231">[RFC2231]</b></td> 761 <td class="top"><a href="mailto:ned.freed@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:moore@cs.utk.edu" title="University of Tennessee">K. Moore</a>, “<a href="http ://tools.ietf.org/html/rfc2231">MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations</a>”, RFC 2231, November 1997.806 <td class="top"><a href="mailto:ned.freed@innosoft.com" title="Innosoft International, Inc.">Freed, N.</a> and <a href="mailto:moore@cs.utk.edu" title="University of Tennessee">K. Moore</a>, “<a href="https://tools.ietf.org/html/rfc2231">MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations</a>”, RFC 2231, November 1997. 762 807 </td> 763 808 </tr> 764 809 <tr> 765 810 <td class="reference"><b id="RFC2388">[RFC2388]</b></td> 766 <td class="top"><a href="mailto:masinter@parc.xerox.com" title="Xerox Palo Alto Research Center">Masinter, L.</a>, “<a href="http ://tools.ietf.org/html/rfc2388">Returning Values from Forms: multipart/form-data</a>”, RFC 2388, August 1998.811 <td class="top"><a href="mailto:masinter@parc.xerox.com" title="Xerox Palo Alto Research Center">Masinter, L.</a>, “<a href="https://tools.ietf.org/html/rfc2388">Returning Values from Forms: multipart/form-data</a>”, RFC 2388, August 1998. 767 812 </td> 768 813 </tr> 769 814 <tr> 770 815 <td class="reference"><b id="RFC3864">[RFC3864]</b></td> 771 <td class="top"><a href="mailto:GK-IETF@ninebynine.org" title="Nine by Nine">Klyne, G.</a>, <a href="mailto:mnot@pobox.com" title="BEA Systems">Nottingham, M.</a>, and <a href="mailto:JeffMogul@acm.org" title="HP Labs">J. Mogul</a>, “<a href="http ://tools.ietf.org/html/rfc3864">Registration Procedures for Message Header Fields</a>”, BCP 90, RFC 3864, September 2004.816 <td class="top"><a href="mailto:GK-IETF@ninebynine.org" title="Nine by Nine">Klyne, G.</a>, <a href="mailto:mnot@pobox.com" title="BEA Systems">Nottingham, M.</a>, and <a href="mailto:JeffMogul@acm.org" title="HP Labs">J. Mogul</a>, “<a href="https://tools.ietf.org/html/rfc3864">Registration Procedures for Message Header Fields</a>”, BCP 90, RFC 3864, September 2004. 772 817 </td> 773 818 </tr> 774 819 <tr> 775 820 <td class="reference"><b id="RFC3986">[RFC3986]</b></td> 776 <td class="top"><a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:fielding@gbiv.com" title="Day Software">Fielding, R.</a>, and <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">L. Masinter</a>, “<a href="http ://tools.ietf.org/html/rfc3986">Uniform Resource Identifier (URI): Generic Syntax</a>”, STD 66, RFC 3986, January 2005.821 <td class="top"><a href="mailto:timbl@w3.org" title="World Wide Web Consortium">Berners-Lee, T.</a>, <a href="mailto:fielding@gbiv.com" title="Day Software">Fielding, R.</a>, and <a href="mailto:LMM@acm.org" title="Adobe Systems Incorporated">L. Masinter</a>, “<a href="https://tools.ietf.org/html/rfc3986">Uniform Resource Identifier (URI): Generic Syntax</a>”, STD 66, RFC 3986, January 2005. 777 822 </td> 778 823 </tr> 779 824 </table> 780 <div class="avoidbreak"> 781 <h1 id="rfc.authors"><a href="#rfc.authors">Author's Address</a></h1> 782 <address class="vcard"><span class="vcardline"><span class="fn">Julian F. Reschke</span><span class="n hidden"><span class="family-name">Reschke</span><span class="given-name">Julian F.</span></span></span><span class="org vcardline">greenbytes GmbH</span><span class="adr"><span class="street-address vcardline">Hafenweg 16</span><span class="vcardline"><span class="locality">Muenster</span>, <span class="region">NW</span> <span class="postal-code">48155</span></span><span class="country-name vcardline">Germany</span></span><span class="vcardline">Email: <a href="mailto:julian.reschke@greenbytes.de"><span class="email">julian.reschke@greenbytes.de</span></a></span><span class="vcardline">URI: <a href="http://greenbytes.de/tech/webdav/" class="url">http://greenbytes.de/tech/webdav/</a></span></address> 783 </div> 784 <h1 id="rfc.section.A" class="np"><a href="#rfc.section.A">A.</a> <a id="changes.from.rfc2616" href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></h1> 785 <p id="rfc.section.A.p.1">Compared to <a href="http://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.10"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, the following normative changes reflecting actual implementations have been made: 786 </p> 787 <ul> 788 <li>According to RFC 2616, the disposition type "attachment" only applies to content of type "application/octet-stream". This 789 restriction has been removed, because recipients in practice do not check the content type, and it also discourages properly 790 declaring the media type. 791 </li> 792 <li>RFC 2616 only allows "quoted-string" for the filename parameter. This would be an exceptional parameter syntax, and also doesn't 793 reflect actual use. 794 </li> 795 <li>The definition for the disposition type "inline" (<a href="#RFC2183" id="rfc.xref.RFC2183.6"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="http://tools.ietf.org/html/rfc2183#section-2.1">Section 2.1</a>) has been re-added with a suggestion for its processing. 796 </li> 797 <li>This specification requires support for the extended parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.8"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>. 798 </li> 799 </ul> 800 <h1 id="rfc.section.B"><a href="#rfc.section.B">B.</a> <a id="diffs.compared.to.rfc2183" href="#diffs.compared.to.rfc2183">Differences compared to RFC 2183</a></h1> 801 <p id="rfc.section.B.p.1"> <a href="http://tools.ietf.org/html/rfc2183#section-2">Section 2</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.7"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines several additional disposition parameters: "creation-date", "modification-date", "quoted-date-time", and "size". The 802 majority of user agents does not implement these, thus they have been omitted from this specification. 803 </p> 804 <h1 id="rfc.section.C"><a href="#rfc.section.C">C.</a> <a id="alternatives" href="#alternatives">Alternative Approaches to Internationalization</a></h1> 805 <p id="rfc.section.C.p.1">By default, HTTP header field parameters cannot carry characters outside the ISO-8859-1 (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.2"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>) character encoding (see <a href="#RFC2616" id="rfc.xref.RFC2616.11"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="http://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>). For the "filename" parameter, this of course is an unacceptable restriction. 806 </p> 807 <p id="rfc.section.C.p.2">Unfortunately, user agent implementers have not managed to come up with an interoperable approach, although the IETF Standards 808 Track specifies exactly one solution (<a href="#RFC2231" id="rfc.xref.RFC2231.1"><cite title="MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations">[RFC2231]</cite></a>, clarified and profiled for HTTP in <a href="#RFC5987" id="rfc.xref.RFC5987.9"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>). 809 </p> 810 <p id="rfc.section.C.p.3">For completeness, the sections below describe the various approaches that have been tried, and explains how they are inferior 811 to the RFC 5987 encoding used in this specification. 812 </p> 813 <h2 id="rfc.section.C.1"><a href="#rfc.section.C.1">C.1</a> <a id="alternatives.rfc2047" href="#alternatives.rfc2047">RFC 2047 Encoding</a></h2> 814 <p id="rfc.section.C.1.p.1">RFC 2047 defines an encoding mechanism for header fields, but this encoding is not supposed to be used for header field parameters 815 - see <a href="http://tools.ietf.org/html/rfc2047#section-5">Section 5</a> of <a href="#RFC2047" id="rfc.xref.RFC2047.1"><cite title="MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text">[RFC2047]</cite></a>: 816 </p> 817 <blockquote id="rfc.section.C.1.p.2" cite="http://tools.ietf.org/html/rfc2047#section-5"> 818 <p>An 'encoded-word' MUST NOT appear within a 'quoted-string'.</p> 819 <p>...</p> 820 <p>An 'encoded-word' MUST NOT be used in parameter of a MIME Content-Type or Content-Disposition field, or in any structured 821 field body except within a 'comment' or 'phrase'. 822 </p> 823 </blockquote> 824 <p id="rfc.section.C.1.p.3">In practice, some user agents implement the encoding, some do not (exposing the encoded string to the user), and some get 825 confused by it. 826 </p> 827 <h2 id="rfc.section.C.2"><a href="#rfc.section.C.2">C.2</a> <a id="alternatives.percent" href="#alternatives.percent">Percent Encoding</a></h2> 828 <p id="rfc.section.C.2.p.1">Some user agents accept percent encoded (<a href="#RFC3986" id="rfc.xref.RFC3986.1"><cite title="Uniform Resource Identifier (URI): Generic Syntax">[RFC3986]</cite></a>, <a href="http://tools.ietf.org/html/rfc3986#section-2.1">Section 2.1</a>) sequences of characters. The character encoding being used for decoding depends on various factors, including the encoding 829 of the referring page, the user agent's locale, its configuration, and also the actual value of the parameter. 830 </p> 831 <p id="rfc.section.C.2.p.2">In practice, this is hard to use because those user agents that do not support it will display the escaped character sequence 832 to the user. For those user agents that do implement this it is difficult to predict what character encoding they actually 833 expect. 834 </p> 835 <h2 id="rfc.section.C.3"><a href="#rfc.section.C.3">C.3</a> <a id="alternatives.sniff" href="#alternatives.sniff">Encoding Sniffing</a></h2> 836 <p id="rfc.section.C.3.p.1">Some user agents inspect the value (which defaults to ISO-8859-1 for the quoted-string form) and switch to UTF-8 when it seems 837 to be more likely to be the correct interpretation. 838 </p> 839 <p id="rfc.section.C.3.p.2">As with the approaches above, this is not interoperable and furthermore risks misinterpreting the actual value.</p> 840 <h2 id="rfc.section.C.4"><a href="#rfc.section.C.4">C.4</a> <a id="alternatives.implementations" href="#alternatives.implementations">Implementations (to be removed by RFC Editor before publication)</a></h2> 841 <p id="rfc.section.C.4.p.1">Unfortunately, as of February 2011, neither the encoding defined in RFCs 2231 and 5987, nor any of the alternate approaches 842 discussed above was implemented interoperably. Thus, this specification recommends the approach defined in RFC 5987, which 843 at least has the advantage of actually being specified properly. 844 </p> 845 <p id="rfc.section.C.4.p.2">The table below shows the implementation support for the various approaches:</p> 846 <div id="rfc.table.u.1"> 847 <table class="tt full left" cellpadding="3" cellspacing="0"> 848 <thead> 849 <tr> 850 <th>User Agent</th> 851 <th>RFC 2231/5987</th> 852 <th>RFC 2047</th> 853 <th>Percent Encoding</th> 854 <th>Encoding Sniffing</th> 855 </tr> 856 </thead> 857 <tbody> 858 <tr> 859 <td class="left">Chrome</td> 860 <td class="left">yes</td> 861 <td class="left">yes</td> 862 <td class="left">yes</td> 863 <td class="left">yes</td> 864 </tr> 865 <tr> 866 <td class="left">Firefox</td> 867 <td class="left">yes (*)</td> 868 <td class="left">yes</td> 869 <td class="left">no</td> 870 <td class="left">yes</td> 871 </tr> 872 <tr> 873 <td class="left">Internet Explorer</td> 874 <td class="left">yes (**)</td> 875 <td class="left">no</td> 876 <td class="left">yes</td> 877 <td class="left">no</td> 878 </tr> 879 <tr> 880 <td class="left">Konqueror</td> 881 <td class="left">yes</td> 882 <td class="left">no</td> 883 <td class="left">no</td> 884 <td class="left">no</td> 885 </tr> 886 <tr> 887 <td class="left">Opera</td> 888 <td class="left">yes</td> 889 <td class="left">no</td> 890 <td class="left">no</td> 891 <td class="left">no</td> 892 </tr> 893 <tr> 894 <td class="left">Safari</td> 895 <td class="left">no</td> 896 <td class="left">no</td> 897 <td class="left">no</td> 898 <td class="left">yes</td> 899 </tr> 900 </tbody> 901 </table> 902 </div> 903 <p id="rfc.section.C.4.p.3">(*) Does not implement the fallback behavior to "filename" described in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>; a fix is planned for Firefox 5. 904 </p> 905 <p id="rfc.section.C.4.p.4">(**) Starting with IE9RC, but only implements UTF-8.</p> 906 <h1 id="rfc.section.D"><a href="#rfc.section.D">D.</a> <a id="advice.generating" href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></h1> 907 <p id="rfc.section.D.p.1">To successfully interoperate with existing and future user agents, senders of the Content-Disposition header field are advised 908 to: 909 </p> 910 <p id="rfc.section.D.p.2"> </p> 911 <ul> 912 <li>Include a "filename" parameter when US-ASCII is sufficiently expressive.</li> 913 <li>Use the 'token' form of the filename parameter only when it does not contain disallowed characters (e.g., spaces); in such 914 cases, the quoted-string form should be used. 915 </li> 916 <li>Avoid including the percent character followed by two hexadecimal characters (e.g., %A9) in the filename parameter, since 917 some existing implementations consider it to be an escape character, while others will pass it through unchanged. 918 </li> 919 <li>Avoid including the "\" character in the quoted-string form of the filename parameter, as escaping is not implemented by some 920 user agents, and can be considered as an illegal path character. 921 </li> 922 <li>Avoid using non-ASCII characters in the filename parameter. Although most existing implementations will decode them as ISO-8859-1, 923 some will apply heuristics to detect UTF-8, and thus might fail on certain names. 924 </li> 925 <li>Include a "filename*" parameter where the desired filename cannot be expressed faithfully using the "filename" form. Note 926 that legacy user agents will not process this, and will fall back to using the "filename" parameter's content. 927 </li> 928 <li>When a "filename*" parameter is sent, to also generate a "filename" parameter as a fallback for user agents that do not support 929 the "filename*" form, if possible. This can be done by substituting characters with US-ASCII sequences (e.g., Unicode character 930 point U+00E4 (LATIN SMALL LETTER A WITH DIARESIS) by "ae"). Note that this may not be possible in some locales. 931 </li> 932 <li>When a "filename" parameter is included as a fallback (as per above), "filename" should occur first, due to parsing problems 933 in some existing implementations. <span class="comment" id="fallbackbug">[<a href="#fallbackbug" class="smpl">fallbackbug</a>: Firefox is known to pick the wrong parameter; a bug fix is scheduled for Firefox 5. --jre]</span> 934 </li> 935 <li>Use UTF-8 as the encoding of the "filename*" parameter, when present, because at least one existing implementation only implements 936 that encoding. 937 </li> 938 </ul> 939 <p id="rfc.section.D.p.3">Note that this advice is based upon UA behaviour at the time of writing, and might be superseded. <<a href="http://purl.org/NET/http/content-disposition-tests">http://purl.org/NET/http/content-disposition-tests</a>> provides an overview of current levels of support in various implementations. 940 </p> 941 <h1 id="rfc.section.E"><a href="#rfc.section.E">E.</a> <a id="change.log" href="#change.log">Change Log (to be removed by RFC Editor before publication)</a></h1> 942 <p id="rfc.section.E.p.1">Note: the issues names in the change log entries for draft-reschke-rfc2183-in-http refer to <<a href="http://greenbytes.de/tech/webdav/draft-reschke-rfc2183-in-http-issues.html">http://greenbytes.de/tech/webdav/draft-reschke-rfc2183-in-http-issues.html</a>>. 943 </p> 944 <h2 id="rfc.section.E.1"><a href="#rfc.section.E.1">E.1</a> Since draft-reschke-rfc2183-in-http-00 945 </h2> 946 <p id="rfc.section.E.1.p.1">Adjust terminology ("header" -> "header field"). Update rfc2231-in-http reference.</p> 947 <h2 id="rfc.section.E.2"><a href="#rfc.section.E.2">E.2</a> Since draft-reschke-rfc2183-in-http-01 948 </h2> 949 <p id="rfc.section.E.2.p.1">Update rfc2231-in-http reference. Actually define the "filename" parameter. Add internationalization considerations. Add examples 950 using the RFC 5987 encoding. Add overview over other approaches, plus a table reporting implementation status. Add and resolve 951 issue "nodep2183". Add issues "asciivsiso", "deplboth", "quoted", and "registry". 952 </p> 953 <h2 id="rfc.section.E.3"><a href="#rfc.section.E.3">E.3</a> Since draft-reschke-rfc2183-in-http-02 954 </h2> 955 <p id="rfc.section.E.3.p.1">Add and close issue "docfallback". Close issues "asciivsiso", "deplboth", "quoted", and "registry".</p> 956 <h2 id="rfc.section.E.4"><a href="#rfc.section.E.4">E.4</a> Since draft-reschke-rfc2183-in-http-03 957 </h2> 958 <p id="rfc.section.E.4.p.1">Updated to be a Working Draft of the IETF HTTPbis Working Group.</p> 959 <h2 id="rfc.section.E.5"><a href="#rfc.section.E.5">E.5</a> <a id="changes.since.00" href="#changes.since.00">Since draft-ietf-httpbis-content-disp-00</a></h2> 960 <p id="rfc.section.E.5.p.1">Closed issues: </p> 961 <ul> 962 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/242">http://tools.ietf.org/wg/httpbis/trac/ticket/242</a>>: "handling of unknown disposition types" 963 </li> 964 </ul> 965 <p id="rfc.section.E.5.p.2">Slightly updated the notes about the proposed fallback behavior.</p> 966 <h2 id="rfc.section.E.6"><a href="#rfc.section.E.6">E.6</a> <a id="changes.since.01" href="#changes.since.01">Since draft-ietf-httpbis-content-disp-01</a></h2> 967 <p id="rfc.section.E.6.p.1">Various editorial improvements.</p> 968 <h2 id="rfc.section.E.7"><a href="#rfc.section.E.7">E.7</a> <a id="changes.since.02" href="#changes.since.02">Since draft-ietf-httpbis-content-disp-02</a></h2> 969 <p id="rfc.section.E.7.p.1">Closed issues: </p> 970 <ul> 971 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/244">http://tools.ietf.org/wg/httpbis/trac/ticket/244</a>>: "state that repeating parameters are invalid" 972 </li> 973 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/245">http://tools.ietf.org/wg/httpbis/trac/ticket/245</a>>: "warn about %xx in filenames being misinterpreted" 974 </li> 975 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/246">http://tools.ietf.org/wg/httpbis/trac/ticket/246</a>>: "mention control chars when talking about postprecessing the filename parameter" 976 </li> 977 </ul> 978 <p id="rfc.section.E.7.p.2">Update <a href="#alternatives.implementations" title="Implementations (to be removed by RFC Editor before publication)">Appendix C.4</a>; Opera 10.63 RC implements the recommended fallback behavior. 979 </p> 980 <h2 id="rfc.section.E.8"><a href="#rfc.section.E.8">E.8</a> <a id="changes.since.03" href="#changes.since.03">Since draft-ietf-httpbis-content-disp-03</a></h2> 981 <p id="rfc.section.E.8.p.1">Closed issues: </p> 982 <ul> 983 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/252">http://tools.ietf.org/wg/httpbis/trac/ticket/252</a>>: "'modification-date' *is* implemented in Konq 4.5" 984 </li> 985 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/253">http://tools.ietf.org/wg/httpbis/trac/ticket/253</a>>: "clarify what LWS means for the Content-Disp grammar" 986 </li> 987 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/258">http://tools.ietf.org/wg/httpbis/trac/ticket/258</a>>: "Avoid passive voice in message requirements" 988 </li> 989 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/263">http://tools.ietf.org/wg/httpbis/trac/ticket/263</a>>: "text about historical percent-decoding unclear" 990 </li> 991 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/264">http://tools.ietf.org/wg/httpbis/trac/ticket/264</a>>: "add explanation of language tagging" 992 </li> 993 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/265">http://tools.ietf.org/wg/httpbis/trac/ticket/265</a>>: "Clarify that C-D spec does not apply to multipart upload" 994 </li> 995 </ul> 996 <h2 id="rfc.section.E.9"><a href="#rfc.section.E.9">E.9</a> <a id="changes.since.04" href="#changes.since.04">Since draft-ietf-httpbis-content-disp-04</a></h2> 997 <p id="rfc.section.E.9.p.1">Updated implementation information (Chrome 9 implements RFC 5987, IE 9 RC implements it for UTF-8 only).</p> 998 <p id="rfc.section.E.9.p.2">Clarify who requirements are on, add a section discussing conformance and handling of invalid field values in general.</p> 999 <p id="rfc.section.E.9.p.3">Closed issues: </p> 1000 <ul> 1001 <li> <<a href="http://trac.tools.ietf.org/wg/httpbis/trac/ticket/243">http://trac.tools.ietf.org/wg/httpbis/trac/ticket/243</a>>: "avoid stating ISO-8859-1 default for header param" (the default is still mentioned, but it was clarified what it applies 1002 to). 1003 </li> 1004 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/272">http://tools.ietf.org/wg/httpbis/trac/ticket/272</a>>: "Path Separator Characters" 1005 </li> 1006 </ul> 1007 <h2 id="rfc.section.E.10"><a href="#rfc.section.E.10">E.10</a> <a id="changes.since.05" href="#changes.since.05">Since draft-ietf-httpbis-content-disp-05</a></h2> 1008 <p id="rfc.section.E.10.p.1">Editorial changes: Fixed two typos where the new Conformance section said "Content-Location" instead of "Content-Disposition". 1009 Cleaned up terminology ("user agent", "recipient", "sender", "message body", ...). Stated what the escape character for quoted-string 1010 is. Explained a use case for "inline" disposition type. Updated implementation notes with respect to the fallback behavior. 1011 </p> 1012 <p id="rfc.section.E.10.p.2">Added appendix "Advice on Generating Content-Disposition Header Fields".</p> 825 <div id="changes.from.rfc2616"> 826 <h1 id="rfc.section.A" class="np"><a href="#rfc.section.A">A.</a> <a href="#changes.from.rfc2616">Changes from the RFC 2616 Definition</a></h1> 827 <p id="rfc.section.A.p.1">Compared to <a href="https://tools.ietf.org/html/rfc2616#section-19.5.1">Section 19.5.1</a> of <a href="#RFC2616" id="rfc.xref.RFC2616.10"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, the following normative changes reflecting actual implementations have been made: 828 </p> 829 <ul> 830 <li>According to RFC 2616, the disposition type "attachment" only applies to content of type "application/octet-stream". This 831 restriction has been removed, because recipients in practice do not check the content type, and it also discourages properly 832 declaring the media type. 833 </li> 834 <li>RFC 2616 only allows "quoted-string" for the filename parameter. This would be an exceptional parameter syntax, and also doesn't 835 reflect actual use. 836 </li> 837 <li>The definition for the disposition type "inline" (<a href="#RFC2183" id="rfc.xref.RFC2183.6"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, <a href="https://tools.ietf.org/html/rfc2183#section-2.1">Section 2.1</a>) has been re-added with a suggestion for its processing. 838 </li> 839 <li>This specification requires support for the extended parameter encoding defined in <a href="#RFC5987" id="rfc.xref.RFC5987.8"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>. 840 </li> 841 </ul> 842 </div> 843 <div id="diffs.compared.to.rfc2183"> 844 <h1 id="rfc.section.B"><a href="#rfc.section.B">B.</a> <a href="#diffs.compared.to.rfc2183">Differences compared to RFC 2183</a></h1> 845 <p id="rfc.section.B.p.1"><a href="https://tools.ietf.org/html/rfc2183#section-2">Section 2</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.7"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> defines several additional disposition parameters: "creation-date", "modification-date", "quoted-date-time", and "size". The 846 majority of user agents does not implement these, thus they have been omitted from this specification. 847 </p> 848 </div> 849 <div id="alternatives"> 850 <h1 id="rfc.section.C"><a href="#rfc.section.C">C.</a> <a href="#alternatives">Alternative Approaches to Internationalization</a></h1> 851 <p id="rfc.section.C.p.1">By default, HTTP header field parameters cannot carry characters outside the ISO-8859-1 (<a href="#ISO-8859-1" id="rfc.xref.ISO-8859-1.2"><cite title="Information technology -- 8-bit single-byte coded graphic character sets -- Part 1: Latin alphabet No. 1">[ISO-8859-1]</cite></a>) character encoding (see <a href="#RFC2616" id="rfc.xref.RFC2616.11"><cite title="Hypertext Transfer Protocol -- HTTP/1.1">[RFC2616]</cite></a>, <a href="https://tools.ietf.org/html/rfc2616#section-2.2">Section 2.2</a>). For the "filename" parameter, this of course is an unacceptable restriction. 852 </p> 853 <p id="rfc.section.C.p.2">Unfortunately, user agent implementers have not managed to come up with an interoperable approach, although the IETF Standards 854 Track specifies exactly one solution (<a href="#RFC2231" id="rfc.xref.RFC2231.1"><cite title="MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations">[RFC2231]</cite></a>, clarified and profiled for HTTP in <a href="#RFC5987" id="rfc.xref.RFC5987.9"><cite title="Character Set and Language Encoding for Hypertext Transfer Protocol (HTTP) Header Field Parameters">[RFC5987]</cite></a>). 855 </p> 856 <p id="rfc.section.C.p.3">For completeness, the sections below describe the various approaches that have been tried, and explains how they are inferior 857 to the RFC 5987 encoding used in this specification. 858 </p> 859 <div id="alternatives.rfc2047"> 860 <h2 id="rfc.section.C.1"><a href="#rfc.section.C.1">C.1</a> <a href="#alternatives.rfc2047">RFC 2047 Encoding</a></h2> 861 <p id="rfc.section.C.1.p.1">RFC 2047 defines an encoding mechanism for header fields, but this encoding is not supposed to be used for header field parameters 862 - see <a href="https://tools.ietf.org/html/rfc2047#section-5">Section 5</a> of <a href="#RFC2047" id="rfc.xref.RFC2047.1"><cite title="MIME (Multipurpose Internet Mail Extensions) Part Three: Message Header Extensions for Non-ASCII Text">[RFC2047]</cite></a>: 863 </p> 864 <blockquote id="rfc.section.C.1.p.2" cite="http://tools.ietf.org/html/rfc2047#section-5"> 865 <p>An 'encoded-word' MUST NOT appear within a 'quoted-string'.</p> 866 <p>...</p> 867 <p>An 'encoded-word' MUST NOT be used in parameter of a MIME Content-Type or Content-Disposition field, or in any structured 868 field body except within a 'comment' or 'phrase'. 869 </p> 870 </blockquote> 871 <p id="rfc.section.C.1.p.3">In practice, some user agents implement the encoding, some do not (exposing the encoded string to the user), and some get 872 confused by it. 873 </p> 874 </div> 875 <div id="alternatives.percent"> 876 <h2 id="rfc.section.C.2"><a href="#rfc.section.C.2">C.2</a> <a href="#alternatives.percent">Percent Encoding</a></h2> 877 <p id="rfc.section.C.2.p.1">Some user agents accept percent encoded (<a href="#RFC3986" id="rfc.xref.RFC3986.1"><cite title="Uniform Resource Identifier (URI): Generic Syntax">[RFC3986]</cite></a>, <a href="https://tools.ietf.org/html/rfc3986#section-2.1">Section 2.1</a>) sequences of characters. The character encoding being used for decoding depends on various factors, including the encoding 878 of the referring page, the user agent's locale, its configuration, and also the actual value of the parameter. 879 </p> 880 <p id="rfc.section.C.2.p.2">In practice, this is hard to use because those user agents that do not support it will display the escaped character sequence 881 to the user. For those user agents that do implement this it is difficult to predict what character encoding they actually 882 expect. 883 </p> 884 </div> 885 <div id="alternatives.sniff"> 886 <h2 id="rfc.section.C.3"><a href="#rfc.section.C.3">C.3</a> <a href="#alternatives.sniff">Encoding Sniffing</a></h2> 887 <p id="rfc.section.C.3.p.1">Some user agents inspect the value (which defaults to ISO-8859-1 for the quoted-string form) and switch to UTF-8 when it seems 888 to be more likely to be the correct interpretation. 889 </p> 890 <p id="rfc.section.C.3.p.2">As with the approaches above, this is not interoperable and furthermore risks misinterpreting the actual value.</p> 891 </div> 892 <div id="alternatives.implementations"> 893 <h2 id="rfc.section.C.4"><a href="#rfc.section.C.4">C.4</a> <a href="#alternatives.implementations">Implementations (to be removed by RFC Editor before publication)</a></h2> 894 <p id="rfc.section.C.4.p.1">Unfortunately, as of February 2011, neither the encoding defined in RFCs 2231 and 5987, nor any of the alternate approaches 895 discussed above was implemented interoperably. Thus, this specification recommends the approach defined in RFC 5987, which 896 at least has the advantage of actually being specified properly. 897 </p> 898 <p id="rfc.section.C.4.p.2">The table below shows the implementation support for the various approaches:</p> 899 <div id="rfc.table.u.1"> 900 <table class="tt full left" cellpadding="3" cellspacing="0"> 901 <thead> 902 <tr> 903 <th>User Agent</th> 904 <th>RFC 2231/5987</th> 905 <th>RFC 2047</th> 906 <th>Percent Encoding</th> 907 <th>Encoding Sniffing</th> 908 </tr> 909 </thead> 910 <tbody> 911 <tr> 912 <td class="left">Chrome</td> 913 <td class="left">yes</td> 914 <td class="left">yes</td> 915 <td class="left">yes</td> 916 <td class="left">yes</td> 917 </tr> 918 <tr> 919 <td class="left">Firefox</td> 920 <td class="left">yes (*)</td> 921 <td class="left">yes</td> 922 <td class="left">no</td> 923 <td class="left">yes</td> 924 </tr> 925 <tr> 926 <td class="left">Internet Explorer</td> 927 <td class="left">yes (**)</td> 928 <td class="left">no</td> 929 <td class="left">yes</td> 930 <td class="left">no</td> 931 </tr> 932 <tr> 933 <td class="left">Konqueror</td> 934 <td class="left">yes</td> 935 <td class="left">no</td> 936 <td class="left">no</td> 937 <td class="left">no</td> 938 </tr> 939 <tr> 940 <td class="left">Opera</td> 941 <td class="left">yes</td> 942 <td class="left">no</td> 943 <td class="left">no</td> 944 <td class="left">no</td> 945 </tr> 946 <tr> 947 <td class="left">Safari</td> 948 <td class="left">no</td> 949 <td class="left">no</td> 950 <td class="left">no</td> 951 <td class="left">yes</td> 952 </tr> 953 </tbody> 954 </table> 955 </div> 956 <p id="rfc.section.C.4.p.3">(*) Does not implement the fallback behavior to "filename" described in <a href="#disposition.parameter.filename" title="Disposition Parameter: 'Filename'">Section 4.3</a>; a fix is planned for Firefox 5. 957 </p> 958 <p id="rfc.section.C.4.p.4">(**) Starting with IE9RC, but only implements UTF-8.</p> 959 </div> 960 </div> 961 <div id="advice.generating"> 962 <h1 id="rfc.section.D"><a href="#rfc.section.D">D.</a> <a href="#advice.generating">Advice on Generating Content-Disposition Header Fields</a></h1> 963 <p id="rfc.section.D.p.1">To successfully interoperate with existing and future user agents, senders of the Content-Disposition header field are advised 964 to: 965 </p> 966 <p id="rfc.section.D.p.2"></p> 967 <ul> 968 <li>Include a "filename" parameter when US-ASCII is sufficiently expressive.</li> 969 <li>Use the 'token' form of the filename parameter only when it does not contain disallowed characters (e.g., spaces); in such 970 cases, the quoted-string form should be used. 971 </li> 972 <li>Avoid including the percent character followed by two hexadecimal characters (e.g., %A9) in the filename parameter, since 973 some existing implementations consider it to be an escape character, while others will pass it through unchanged. 974 </li> 975 <li>Avoid including the "\" character in the quoted-string form of the filename parameter, as escaping is not implemented by some 976 user agents, and can be considered as an illegal path character. 977 </li> 978 <li>Avoid using non-ASCII characters in the filename parameter. Although most existing implementations will decode them as ISO-8859-1, 979 some will apply heuristics to detect UTF-8, and thus might fail on certain names. 980 </li> 981 <li>Include a "filename*" parameter where the desired filename cannot be expressed faithfully using the "filename" form. Note 982 that legacy user agents will not process this, and will fall back to using the "filename" parameter's content. 983 </li> 984 <li>When a "filename*" parameter is sent, to also generate a "filename" parameter as a fallback for user agents that do not support 985 the "filename*" form, if possible. This can be done by substituting characters with US-ASCII sequences (e.g., Unicode character 986 point U+00E4 (LATIN SMALL LETTER A WITH DIARESIS) by "ae"). Note that this may not be possible in some locales. 987 </li> 988 <li>When a "filename" parameter is included as a fallback (as per above), "filename" should occur first, due to parsing problems 989 in some existing implementations. <span class="comment" id="fallbackbug">[<a href="#fallbackbug" class="smpl">fallbackbug</a>: Firefox is known to pick the wrong parameter; a bug fix is scheduled for Firefox 5. --jre]</span> 990 </li> 991 <li>Use UTF-8 as the encoding of the "filename*" parameter, when present, because at least one existing implementation only implements 992 that encoding. 993 </li> 994 </ul> 995 <p id="rfc.section.D.p.3">Note that this advice is based upon UA behaviour at the time of writing, and might be superseded. <<a href="http://purl.org/NET/http/content-disposition-tests">http://purl.org/NET/http/content-disposition-tests</a>> provides an overview of current levels of support in various implementations. 996 </p> 997 </div> 998 <div id="change.log"> 999 <h1 id="rfc.section.E"><a href="#rfc.section.E">E.</a> <a href="#change.log">Change Log (to be removed by RFC Editor before publication)</a></h1> 1000 <p id="rfc.section.E.p.1">Note: the issues names in the change log entries for draft-reschke-rfc2183-in-http refer to <<a href="http://greenbytes.de/tech/webdav/draft-reschke-rfc2183-in-http-issues.html">http://greenbytes.de/tech/webdav/draft-reschke-rfc2183-in-http-issues.html</a>>. 1001 </p> 1002 <div> 1003 <h2 id="rfc.section.E.1"><a href="#rfc.section.E.1">E.1</a> Since draft-reschke-rfc2183-in-http-00 1004 </h2> 1005 <p id="rfc.section.E.1.p.1">Adjust terminology ("header" -> "header field"). Update rfc2231-in-http reference.</p> 1006 </div> 1007 <div> 1008 <h2 id="rfc.section.E.2"><a href="#rfc.section.E.2">E.2</a> Since draft-reschke-rfc2183-in-http-01 1009 </h2> 1010 <p id="rfc.section.E.2.p.1">Update rfc2231-in-http reference. Actually define the "filename" parameter. Add internationalization considerations. Add examples 1011 using the RFC 5987 encoding. Add overview over other approaches, plus a table reporting implementation status. Add and resolve 1012 issue "nodep2183". Add issues "asciivsiso", "deplboth", "quoted", and "registry". 1013 </p> 1014 </div> 1015 <div> 1016 <h2 id="rfc.section.E.3"><a href="#rfc.section.E.3">E.3</a> Since draft-reschke-rfc2183-in-http-02 1017 </h2> 1018 <p id="rfc.section.E.3.p.1">Add and close issue "docfallback". Close issues "asciivsiso", "deplboth", "quoted", and "registry".</p> 1019 </div> 1020 <div> 1021 <h2 id="rfc.section.E.4"><a href="#rfc.section.E.4">E.4</a> Since draft-reschke-rfc2183-in-http-03 1022 </h2> 1023 <p id="rfc.section.E.4.p.1">Updated to be a Working Draft of the IETF HTTPbis Working Group.</p> 1024 </div> 1025 <div id="changes.since.00"> 1026 <h2 id="rfc.section.E.5"><a href="#rfc.section.E.5">E.5</a> <a href="#changes.since.00">Since draft-ietf-httpbis-content-disp-00</a></h2> 1027 <p id="rfc.section.E.5.p.1">Closed issues: </p> 1028 <ul> 1029 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/242">http://tools.ietf.org/wg/httpbis/trac/ticket/242</a>>: "handling of unknown disposition types" 1030 </li> 1031 </ul> 1032 <p id="rfc.section.E.5.p.2">Slightly updated the notes about the proposed fallback behavior.</p> 1033 </div> 1034 <div id="changes.since.01"> 1035 <h2 id="rfc.section.E.6"><a href="#rfc.section.E.6">E.6</a> <a href="#changes.since.01">Since draft-ietf-httpbis-content-disp-01</a></h2> 1036 <p id="rfc.section.E.6.p.1">Various editorial improvements.</p> 1037 </div> 1038 <div id="changes.since.02"> 1039 <h2 id="rfc.section.E.7"><a href="#rfc.section.E.7">E.7</a> <a href="#changes.since.02">Since draft-ietf-httpbis-content-disp-02</a></h2> 1040 <p id="rfc.section.E.7.p.1">Closed issues: </p> 1041 <ul> 1042 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/244">http://tools.ietf.org/wg/httpbis/trac/ticket/244</a>>: "state that repeating parameters are invalid" 1043 </li> 1044 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/245">http://tools.ietf.org/wg/httpbis/trac/ticket/245</a>>: "warn about %xx in filenames being misinterpreted" 1045 </li> 1046 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/246">http://tools.ietf.org/wg/httpbis/trac/ticket/246</a>>: "mention control chars when talking about postprecessing the filename parameter" 1047 </li> 1048 </ul> 1049 <p id="rfc.section.E.7.p.2">Update <a href="#alternatives.implementations" title="Implementations (to be removed by RFC Editor before publication)">Appendix C.4</a>; Opera 10.63 RC implements the recommended fallback behavior. 1050 </p> 1051 </div> 1052 <div id="changes.since.03"> 1053 <h2 id="rfc.section.E.8"><a href="#rfc.section.E.8">E.8</a> <a href="#changes.since.03">Since draft-ietf-httpbis-content-disp-03</a></h2> 1054 <p id="rfc.section.E.8.p.1">Closed issues: </p> 1055 <ul> 1056 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/252">http://tools.ietf.org/wg/httpbis/trac/ticket/252</a>>: "'modification-date' *is* implemented in Konq 4.5" 1057 </li> 1058 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/253">http://tools.ietf.org/wg/httpbis/trac/ticket/253</a>>: "clarify what LWS means for the Content-Disp grammar" 1059 </li> 1060 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/258">http://tools.ietf.org/wg/httpbis/trac/ticket/258</a>>: "Avoid passive voice in message requirements" 1061 </li> 1062 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/263">http://tools.ietf.org/wg/httpbis/trac/ticket/263</a>>: "text about historical percent-decoding unclear" 1063 </li> 1064 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/264">http://tools.ietf.org/wg/httpbis/trac/ticket/264</a>>: "add explanation of language tagging" 1065 </li> 1066 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/265">http://tools.ietf.org/wg/httpbis/trac/ticket/265</a>>: "Clarify that C-D spec does not apply to multipart upload" 1067 </li> 1068 </ul> 1069 </div> 1070 <div id="changes.since.04"> 1071 <h2 id="rfc.section.E.9"><a href="#rfc.section.E.9">E.9</a> <a href="#changes.since.04">Since draft-ietf-httpbis-content-disp-04</a></h2> 1072 <p id="rfc.section.E.9.p.1">Updated implementation information (Chrome 9 implements RFC 5987, IE 9 RC implements it for UTF-8 only).</p> 1073 <p id="rfc.section.E.9.p.2">Clarify who requirements are on, add a section discussing conformance and handling of invalid field values in general.</p> 1074 <p id="rfc.section.E.9.p.3">Closed issues: </p> 1075 <ul> 1076 <li><<a href="http://trac.tools.ietf.org/wg/httpbis/trac/ticket/243">http://trac.tools.ietf.org/wg/httpbis/trac/ticket/243</a>>: "avoid stating ISO-8859-1 default for header param" (the default is still mentioned, but it was clarified what it applies 1077 to). 1078 </li> 1079 <li><<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/272">http://tools.ietf.org/wg/httpbis/trac/ticket/272</a>>: "Path Separator Characters" 1080 </li> 1081 </ul> 1082 </div> 1083 <div id="changes.since.05"> 1084 <h2 id="rfc.section.E.10"><a href="#rfc.section.E.10">E.10</a> <a href="#changes.since.05">Since draft-ietf-httpbis-content-disp-05</a></h2> 1085 <p id="rfc.section.E.10.p.1">Editorial changes: Fixed two typos where the new Conformance section said "Content-Location" instead of "Content-Disposition". 1086 Cleaned up terminology ("user agent", "recipient", "sender", "message body", ...). Stated what the escape character for quoted-string 1087 is. Explained a use case for "inline" disposition type. Updated implementation notes with respect to the fallback behavior. 1088 </p> 1089 <p id="rfc.section.E.10.p.2">Added appendix "Advice on Generating Content-Disposition Header Fields".</p> 1090 </div> 1091 </div> 1013 1092 <h1 id="rfc.index"><a href="#rfc.index">Index</a></h1> 1014 1093 <p class="noprint"><a href="#rfc.index.C">C</a> <a href="#rfc.index.H">H</a> <a href="#rfc.index.I">I</a> <a href="#rfc.index.R">R</a> … … 1071 1150 </ul> 1072 1151 </div> 1152 <div class="avoidbreak"> 1153 <h1 id="rfc.authors"><a href="#rfc.authors">Author's Address</a></h1> 1154 <p><b>Julian F. Reschke</b><br>greenbytes GmbH<br>Hafenweg 16<br>Muenster, NW 48155<br>Germany<br>Email: <a href="mailto:julian.reschke@greenbytes.de">julian.reschke@greenbytes.de</a><br>URI: <a href="http://greenbytes.de/tech/webdav/">http://greenbytes.de/tech/webdav/</a></p> 1155 </div> 1073 1156 </body> 1074 1157 </html>
Note: See TracChangeset
for help on using the changeset viewer.