![(please configure the [header_logo] section in trac.ini)](https://www.ietf.org/images/ietflogotrans.gif)
Changeset 987
- Timestamp:
- 03/09/10 14:48:02 (13 years ago)
- Location:
- draft-ietf-httpbis/latest
- Files:
-
- 2 edited
-
p3-payload.html (modified) (37 diffs)
-
p3-payload.xml (modified) (10 diffs)
Legend:
- Unmodified
- Added
- Removed
-
draft-ietf-httpbis/latest/p3-payload.html
r981 r987 402 402 <meta name="dct.creator" content="Reschke, J. F."> 403 403 <meta name="dct.identifier" content="urn:ietf:id:draft-ietf-httpbis-p3-payload-latest"> 404 <meta name="dct.issued" scheme="ISO8601" content="2010-09-0 1">404 <meta name="dct.issued" scheme="ISO8601" content="2010-09-03"> 405 405 <meta name="dct.replaces" content="urn:ietf:rfc:2616"> 406 406 <meta name="dct.abstract" content="The Hypertext Transfer Protocol (HTTP) is an application-level protocol for distributed, collaborative, hypermedia information systems. HTTP has been in use by the World Wide Web global information initiative since 1990. This document is Part 3 of the seven-part specification that defines the protocol referred to as "HTTP/1.1" and, taken together, obsoletes RFC 2616. Part 3 defines HTTP message content, metadata, and content negotiation."> … … 428 428 </tr> 429 429 <tr> 430 <td class="left">Expires: March 5, 2011</td>430 <td class="left">Expires: March 7, 2011</td> 431 431 <td class="right">J. Mogul</td> 432 432 </tr> … … 485 485 <tr> 486 486 <td class="left"></td> 487 <td class="right">September 1, 2010</td>487 <td class="right">September 3, 2010</td> 488 488 </tr> 489 489 </tbody> … … 511 511 in progress”. 512 512 </p> 513 <p>This Internet-Draft will expire on March 5, 2011.</p>513 <p>This Internet-Draft will expire on March 7, 2011.</p> 514 514 <h1><a id="rfc.copyrightnotice" href="#rfc.copyrightnotice">Copyright Notice</a></h1> 515 515 <p>Copyright © 2010 IETF Trust and the persons identified as the document authors. All rights reserved.</p> … … 590 590 <li class="tocline0">8. <a href="#security.considerations">Security Considerations</a><ul class="toc"> 591 591 <li class="tocline1">8.1 <a href="#privacy.issues.connected.to.accept.headers">Privacy Issues Connected to Accept Headers</a></li> 592 <li class="tocline1">8.2 <a href="#content-disposition.issues">Content-Disposition Issues</a></li>593 592 </ul> 594 593 </li> … … 610 609 </ul> 611 610 </li> 612 <li class="tocline0">B. <a href="#additional.features">Additional Features</a><ul class="toc"> 613 <li class="tocline1">B.1 <a href="#content-disposition">Content-Disposition</a></li> 614 </ul> 615 </li> 611 <li class="tocline0">B. <a href="#additional.features">Additional Features</a></li> 616 612 <li class="tocline0">C. <a href="#changes.from.rfc.2616">Changes from RFC 2616</a></li> 617 613 <li class="tocline0">D. <a href="#collected.abnf">Collected ABNF</a></li> … … 673 669 <p id="rfc.section.1.3.1.p.1">The core rules below are defined in <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.2"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>: 674 670 </p> 675 <div id="rfc.figure.u.1"></div><pre class="inline"> <a href="#core.rules" class="smpl">quoted-string</a> = <quoted-string, defined in <a href="#Part1" id="rfc.xref.Part1.3"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 676 <a href="#core.rules" class="smpl">token</a> = <token, defined in <a href="#Part1" id="rfc.xref.Part1.4"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 677 <a href="#core.rules" class="smpl">word</a> = <word, defined in <a href="#Part1" id="rfc.xref.Part1.5"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 678 <a href="#core.rules" class="smpl">OWS</a> = <OWS, defined in <a href="#Part1" id="rfc.xref.Part1.6"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 671 <div id="rfc.figure.u.1"></div><pre class="inline"> <a href="#core.rules" class="smpl">token</a> = <token, defined in <a href="#Part1" id="rfc.xref.Part1.3"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 672 <a href="#core.rules" class="smpl">word</a> = <word, defined in <a href="#Part1" id="rfc.xref.Part1.4"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 673 <a href="#core.rules" class="smpl">OWS</a> = <OWS, defined in <a href="#Part1" id="rfc.xref.Part1.5"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#basic.rules" title="Basic Rules">Section 1.2.2</a>> 679 674 </pre><h3 id="rfc.section.1.3.2"><a href="#rfc.section.1.3.2">1.3.2</a> <a id="abnf.dependencies" href="#abnf.dependencies">ABNF Rules defined in other Parts of the Specification</a></h3> 680 675 <p id="rfc.section.1.3.2.p.1">The ABNF rules below are defined in other parts:</p> 681 <div id="rfc.figure.u.2"></div><pre class="inline"> <a href="#abnf.dependencies" class="smpl">absolute-URI</a> = <absolute-URI, defined in <a href="#Part1" id="rfc.xref.Part1. 7"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#uri" title="Uniform Resource Identifiers">Section 2.6</a>>682 <a href="#abnf.dependencies" class="smpl">Content-Length</a> = <Content-Length, defined in <a href="#Part1" id="rfc.xref.Part1. 8"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#header.content-length" title="Content-Length">Section 9.2</a>>683 <a href="#abnf.dependencies" class="smpl">partial-URI</a> = <partial-URI, defined in <a href="#Part1" id="rfc.xref.Part1. 9"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#uri" title="Uniform Resource Identifiers">Section 2.6</a>>684 <a href="#abnf.dependencies" class="smpl">qvalue</a> = <qvalue, defined in <a href="#Part1" id="rfc.xref.Part1. 10"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#quality.values" title="Quality Values">Section 6.4</a>>676 <div id="rfc.figure.u.2"></div><pre class="inline"> <a href="#abnf.dependencies" class="smpl">absolute-URI</a> = <absolute-URI, defined in <a href="#Part1" id="rfc.xref.Part1.6"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#uri" title="Uniform Resource Identifiers">Section 2.6</a>> 677 <a href="#abnf.dependencies" class="smpl">Content-Length</a> = <Content-Length, defined in <a href="#Part1" id="rfc.xref.Part1.7"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#header.content-length" title="Content-Length">Section 9.2</a>> 678 <a href="#abnf.dependencies" class="smpl">partial-URI</a> = <partial-URI, defined in <a href="#Part1" id="rfc.xref.Part1.8"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#uri" title="Uniform Resource Identifiers">Section 2.6</a>> 679 <a href="#abnf.dependencies" class="smpl">qvalue</a> = <qvalue, defined in <a href="#Part1" id="rfc.xref.Part1.9"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#quality.values" title="Quality Values">Section 6.4</a>> 685 680 </pre><div id="rfc.figure.u.3"></div><pre class="inline"> <a href="#abnf.dependencies" class="smpl">Last-Modified</a> = <Last-Modified, defined in <a href="#Part4" id="rfc.xref.Part4.1"><cite title="HTTP/1.1, part 4: Conditional Requests">[Part4]</cite></a>, <a href="p4-conditional.html#header.last-modified" title="Last-Modified">Section 6.6</a>> 686 681 </pre><div id="rfc.figure.u.4"></div><pre class="inline"> <a href="#abnf.dependencies" class="smpl">Content-Range</a> = <Content-Range, defined in <a href="#Part5" id="rfc.xref.Part5.1"><cite title="HTTP/1.1, part 5: Range Requests and Partial Responses">[Part5]</cite></a>, <a href="p5-range.html#header.content-range" title="Content-Range">Section 5.2</a>> … … 737 732 </p> 738 733 <ul class="empty"> 739 <li>See <a href="p1-messaging.html#compress.coding" title="Compress Coding">Section 6.2.2.1</a> of <a href="#Part1" id="rfc.xref.Part1.1 1"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>.734 <li>See <a href="p1-messaging.html#compress.coding" title="Compress Coding">Section 6.2.2.1</a> of <a href="#Part1" id="rfc.xref.Part1.10"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>. 740 735 </li> 741 736 </ul> … … 743 738 </p> 744 739 <ul class="empty"> 745 <li>See <a href="p1-messaging.html#deflate.coding" title="Deflate Coding">Section 6.2.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.1 2"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>.740 <li>See <a href="p1-messaging.html#deflate.coding" title="Deflate Coding">Section 6.2.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.11"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>. 746 741 </li> 747 742 </ul> … … 749 744 </p> 750 745 <ul class="empty"> 751 <li>See <a href="p1-messaging.html#gzip.coding" title="Gzip Coding">Section 6.2.2.3</a> of <a href="#Part1" id="rfc.xref.Part1.1 3"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>.746 <li>See <a href="p1-messaging.html#gzip.coding" title="Gzip Coding">Section 6.2.2.3</a> of <a href="#Part1" id="rfc.xref.Part1.12"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>. 752 747 </li> 753 748 </ul> … … 768 763 <li>Pointer to specification text</li> 769 764 </ul> 770 <p id="rfc.section.2.2.1.p.3">Names of content codings <em class="bcp14">MUST NOT</em> overlap with names of transfer codings (<a href="p1-messaging.html#transfer.codings" title="Transfer Codings">Section 6.2</a> of <a href="#Part1" id="rfc.xref.Part1.1 4"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>), unless the encoding transformation is identical (as it is the case for the compression codings defined in <a href="p1-messaging.html#compression.codings" title="Compression Codings">Section 6.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.15"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>).765 <p id="rfc.section.2.2.1.p.3">Names of content codings <em class="bcp14">MUST NOT</em> overlap with names of transfer codings (<a href="p1-messaging.html#transfer.codings" title="Transfer Codings">Section 6.2</a> of <a href="#Part1" id="rfc.xref.Part1.13"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>), unless the encoding transformation is identical (as it is the case for the compression codings defined in <a href="p1-messaging.html#compression.codings" title="Compression Codings">Section 6.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.14"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). 771 766 </p> 772 767 <p id="rfc.section.2.2.1.p.4">Values to be added to this name space require a specification (see "Specification Required" in <a href="http://tools.ietf.org/html/rfc5226#section-4.1">Section 4.1</a> of <a href="#RFC5226" id="rfc.xref.RFC5226.1"><cite title="Guidelines for Writing an IANA Considerations Section in RFCs">[RFC5226]</cite></a>), and <em class="bcp14">MUST</em> conform to the purpose of content coding defined in this section. … … 861 856 header fields". The following payload header fields are defined by HTTP/1.1: 862 857 </p> 863 <div id="rfc.figure.u.12"></div><pre> <a href="#abnf.dependencies" class="smpl">Content-Length</a> ; <a href="#Part1" id="rfc.xref.Part1.1 6"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#header.content-length" title="Content-Length">Section 9.2</a>858 <div id="rfc.figure.u.12"></div><pre> <a href="#abnf.dependencies" class="smpl">Content-Length</a> ; <a href="#Part1" id="rfc.xref.Part1.15"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, <a href="p1-messaging.html#header.content-length" title="Content-Length">Section 9.2</a> 864 859 <a href="#header.content-md5" class="smpl">Content-MD5</a> ; <a href="#header.content-md5" id="rfc.xref.header.content-md5.1" title="Content-MD5">Section 6.8</a> 865 860 <a href="#abnf.dependencies" class="smpl">Content-Range</a> ; <a href="#Part5" id="rfc.xref.Part5.2"><cite title="HTTP/1.1, part 5: Range Requests and Partial Responses">[Part5]</cite></a>, <a href="p5-range.html#header.content-range" title="Content-Range">Section 5.2</a> 866 861 </pre><h2 id="rfc.section.3.2"><a href="#rfc.section.3.2">3.2</a> <a id="payload.body" href="#payload.body">Payload Body</a></h2> 867 <p id="rfc.section.3.2.p.1">A payload body is only present in a message when a message-body is present, as described in <a href="p1-messaging.html#message.body" title="Message Body">Section 3.3</a> of <a href="#Part1" id="rfc.xref.Part1.1 7"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>. The payload body is obtained from the message-body by decoding any Transfer-Encoding that might have been applied to ensure862 <p id="rfc.section.3.2.p.1">A payload body is only present in a message when a message-body is present, as described in <a href="p1-messaging.html#message.body" title="Message Body">Section 3.3</a> of <a href="#Part1" id="rfc.xref.Part1.16"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>. The payload body is obtained from the message-body by decoding any Transfer-Encoding that might have been applied to ensure 868 863 safe and proper transfer of the message. 869 864 </p> … … 1020 1015 <p id="rfc.section.6.1.p.4">Each media-range <em class="bcp14">MAY</em> be followed by one or more accept-params, beginning with the "q" parameter for indicating a relative quality factor. The first 1021 1016 "q" parameter (if any) separates the media-range parameter(s) from the accept-params. Quality factors allow the user or user 1022 agent to indicate the relative degree of preference for that media-range, using the qvalue scale from 0 to 1 (<a href="p1-messaging.html#quality.values" title="Quality Values">Section 6.4</a> of <a href="#Part1" id="rfc.xref.Part1.1 8"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). The default value is q=1.1017 agent to indicate the relative degree of preference for that media-range, using the qvalue scale from 0 to 1 (<a href="p1-messaging.html#quality.values" title="Quality Values">Section 6.4</a> of <a href="#Part1" id="rfc.xref.Part1.17"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). The default value is q=1. 1023 1018 </p> 1024 1019 <div class="note" id="rfc.section.6.1.p.5"> … … 1144 1139 <ol> 1145 1140 <li>If the content-coding is one of the content-codings listed in the Accept-Encoding field, then it is acceptable, unless it 1146 is accompanied by a qvalue of 0. (As defined in <a href="p1-messaging.html#quality.values" title="Quality Values">Section 6.4</a> of <a href="#Part1" id="rfc.xref.Part1.1 9"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, a qvalue of 0 means "not acceptable".)1141 is accompanied by a qvalue of 0. (As defined in <a href="p1-messaging.html#quality.values" title="Quality Values">Section 6.4</a> of <a href="#Part1" id="rfc.xref.Part1.18"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>, a qvalue of 0 means "not acceptable".) 1147 1142 </li> 1148 1143 <li>The special "*" symbol in an Accept-Encoding field matches any available content-coding not explicitly listed in the header … … 1271 1266 <a href="#header.content-location" class="smpl">Content-Location-v</a> = 1272 1267 <a href="#abnf.dependencies" class="smpl">absolute-URI</a> / <a href="#abnf.dependencies" class="smpl">partial-URI</a> 1273 </pre><p id="rfc.section.6.7.p.3">The Content-Location value is not a replacement for the effective Request URI (<a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1. 20"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). It is representation metadata. It has the same syntax and semantics as the header field of the same name defined for MIME1268 </pre><p id="rfc.section.6.7.p.3">The Content-Location value is not a replacement for the effective Request URI (<a href="p1-messaging.html#effective.request.uri" title="Effective Request URI">Section 4.3</a> of <a href="#Part1" id="rfc.xref.Part1.19"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). It is representation metadata. It has the same syntax and semantics as the header field of the same name defined for MIME 1274 1269 body parts in <a href="http://tools.ietf.org/html/rfc2557#section-4">Section 4</a> of <a href="#RFC2557" id="rfc.xref.RFC2557.1"><cite title="MIME Encapsulation of Aggregate Documents, such as HTML (MHTML)">[RFC2557]</cite></a>. However, its appearance in an HTTP message has some special implications for HTTP recipients. 1275 1270 </p> … … 1395 1390 <td class="left">standard</td> 1396 1391 <td class="left"> <a href="#header.accept-language" id="rfc.xref.header.accept-language.2" title="Accept-Language">Section 6.4</a> 1397 </td>1398 </tr>1399 <tr>1400 <td class="left">Content-Disposition</td>1401 <td class="left">http</td>1402 <td class="left">standard</td>1403 <td class="left"> <a href="#content-disposition" id="rfc.xref.content-disposition.1" title="Content-Disposition">Appendix B.1</a>1404 1392 </td> 1405 1393 </tr> … … 1469 1457 <td class="left">compress</td> 1470 1458 <td class="left">UNIX "compress" program method</td> 1471 <td class="left"> <a href="p1-messaging.html#compress.coding" title="Compress Coding">Section 6.2.2.1</a> of <a href="#Part1" id="rfc.xref.Part1.2 1"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>1459 <td class="left"> <a href="p1-messaging.html#compress.coding" title="Compress Coding">Section 6.2.2.1</a> of <a href="#Part1" id="rfc.xref.Part1.20"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a> 1472 1460 </td> 1473 1461 </tr> … … 1476 1464 <td class="left">"deflate" compression mechanism (<a href="#RFC1951" id="rfc.xref.RFC1951.1"><cite title="DEFLATE Compressed Data Format Specification version 1.3">[RFC1951]</cite></a>) used inside the "zlib" data format (<a href="#RFC1950" id="rfc.xref.RFC1950.1"><cite title="ZLIB Compressed Data Format Specification version 3.3">[RFC1950]</cite></a>) 1477 1465 </td> 1478 <td class="left"> <a href="p1-messaging.html#deflate.coding" title="Deflate Coding">Section 6.2.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.2 2"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>1466 <td class="left"> <a href="p1-messaging.html#deflate.coding" title="Deflate Coding">Section 6.2.2.2</a> of <a href="#Part1" id="rfc.xref.Part1.21"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a> 1479 1467 </td> 1480 1468 </tr> … … 1482 1470 <td class="left">gzip</td> 1483 1471 <td class="left">Same as GNU zip <a href="#RFC1952" id="rfc.xref.RFC1952.1"><cite title="GZIP file format specification version 4.3">[RFC1952]</cite></a></td> 1484 <td class="left"> <a href="p1-messaging.html#gzip.coding" title="Gzip Coding">Section 6.2.2.3</a> of <a href="#Part1" id="rfc.xref.Part1.2 3"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>1472 <td class="left"> <a href="p1-messaging.html#gzip.coding" title="Gzip Coding">Section 6.2.2.3</a> of <a href="#Part1" id="rfc.xref.Part1.22"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a> 1485 1473 </td> 1486 1474 </tr> … … 1518 1506 filter the accept headers in relayed requests. General purpose user agents which provide a high degree of header configurability <em class="bcp14">SHOULD</em> warn users about the loss of privacy which can be involved. 1519 1507 </p> 1520 <h2 id="rfc.section.8.2"><a href="#rfc.section.8.2">8.2</a> <a id="content-disposition.issues" href="#content-disposition.issues">Content-Disposition Issues</a></h2>1521 <p id="rfc.section.8.2.p.1"> <a href="#RFC2183" id="rfc.xref.RFC2183.1"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>, from which the often implemented Content-Disposition (see <a href="#content-disposition" id="rfc.xref.content-disposition.2" title="Content-Disposition">Appendix B.1</a>) header in HTTP is derived, has a number of very serious security considerations. Content-Disposition is not part of the1522 HTTP standard, but since it is widely implemented, we are documenting its use and risks for implementors. See <a href="http://tools.ietf.org/html/rfc2183#section-5">Section 5</a> of <a href="#RFC2183" id="rfc.xref.RFC2183.2"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a> for details.1523 </p>1524 1508 <h1 id="rfc.section.9"><a href="#rfc.section.9">9.</a> <a id="ack" href="#ack">Acknowledgments</a></h1> 1525 1509 <h1 id="rfc.references"><a id="rfc.section.10" href="#rfc.section.10">10.</a> References … … 1613 1597 <h2 id="rfc.references.2"><a href="#rfc.section.10.2" id="rfc.section.10.2">10.2</a> Informative References 1614 1598 </h2> 1615 <table> 1599 <table> 1616 1600 <tr> 1617 1601 <td class="reference"><b id="BCP97">[BCP97]</b></td> … … 1637 1621 <td class="reference"><b id="RFC2076">[RFC2076]</b></td> 1638 1622 <td class="top"><a href="mailto:jpalme@dsv.su.se" title="Stockholm University/KTH">Palme, J.</a>, “<a href="http://tools.ietf.org/html/rfc2076">Common Internet Message Headers</a>”, RFC 2076, February 1997. 1639 </td>1640 </tr>1641 <tr>1642 <td class="reference"><b id="RFC2183">[RFC2183]</b></td>1643 <td class="top"><a href="mailto:rens@century.com" title="New Century Systems">Troost, R.</a>, <a href="mailto:sdorner@qualcomm.com" title="QUALCOMM Incorporated">Dorner, S.</a>, and <a href="mailto:moore@cs.utk.edu" title="Department of Computer Science">K. Moore</a>, “<a href="http://tools.ietf.org/html/rfc2183">Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field</a>”, RFC 2183, August 1997.1644 1623 </td> 1645 1624 </tr> … … 1748 1727 </p> 1749 1728 <h2 id="rfc.section.A.3"><a href="#rfc.section.A.3">A.3</a> <a id="conversion.of.date.formats" href="#conversion.of.date.formats">Conversion of Date Formats</a></h2> 1750 <p id="rfc.section.A.3.p.1">HTTP/1.1 uses a restricted set of date formats (<a href="p1-messaging.html#date.time.formats.full.date" title="Date/Time Formats: Full Date">Section 6.1</a> of <a href="#Part1" id="rfc.xref.Part1.2 4"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>) to simplify the process of date comparison. Proxies and gateways from other protocols <em class="bcp14">SHOULD</em> ensure that any Date header field present in a message conforms to one of the HTTP/1.1 formats and rewrite the date if necessary.1729 <p id="rfc.section.A.3.p.1">HTTP/1.1 uses a restricted set of date formats (<a href="p1-messaging.html#date.time.formats.full.date" title="Date/Time Formats: Full Date">Section 6.1</a> of <a href="#Part1" id="rfc.xref.Part1.23"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>) to simplify the process of date comparison. Proxies and gateways from other protocols <em class="bcp14">SHOULD</em> ensure that any Date header field present in a message conforms to one of the HTTP/1.1 formats and rewrite the date if necessary. 1751 1730 </p> 1752 1731 <h2 id="rfc.section.A.4"><a href="#rfc.section.A.4">A.4</a> <a id="introduction.of.content-encoding" href="#introduction.of.content-encoding">Introduction of Content-Encoding</a></h2> … … 1765 1744 </p> 1766 1745 <h2 id="rfc.section.A.6"><a href="#rfc.section.A.6">A.6</a> <a id="introduction.of.transfer-encoding" href="#introduction.of.transfer-encoding">Introduction of Transfer-Encoding</a></h2> 1767 <p id="rfc.section.A.6.p.1">HTTP/1.1 introduces the Transfer-Encoding header field (<a href="p1-messaging.html#header.transfer-encoding" title="Transfer-Encoding">Section 9.7</a> of <a href="#Part1" id="rfc.xref.Part1.2 5"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). Proxies/gateways <em class="bcp14">MUST</em> remove any transfer-coding prior to forwarding a message via a MIME-compliant protocol.1746 <p id="rfc.section.A.6.p.1">HTTP/1.1 introduces the Transfer-Encoding header field (<a href="p1-messaging.html#header.transfer-encoding" title="Transfer-Encoding">Section 9.7</a> of <a href="#Part1" id="rfc.xref.Part1.24"><cite title="HTTP/1.1, part 1: URIs, Connections, and Message Parsing">[Part1]</cite></a>). Proxies/gateways <em class="bcp14">MUST</em> remove any transfer-coding prior to forwarding a message via a MIME-compliant protocol. 1768 1747 </p> 1769 1748 <h2 id="rfc.section.A.7"><a href="#rfc.section.A.7">A.7</a> <a id="mhtml.line.length" href="#mhtml.line.length">MHTML and Line Length Limitations</a></h2> … … 1780 1759 <p id="rfc.section.B.p.2">A number of other headers, such as Content-Disposition and Title, from SMTP and MIME are also often implemented (see <a href="#RFC2076" id="rfc.xref.RFC2076.1"><cite title="Common Internet Message Headers">[RFC2076]</cite></a>). 1781 1760 </p> 1782 <div id="rfc.iref.h.11"></div>1783 <div id="rfc.iref.c.12"></div>1784 <h2 id="rfc.section.B.1"><a href="#rfc.section.B.1">B.1</a> <a id="content-disposition" href="#content-disposition">Content-Disposition</a></h2>1785 <p id="rfc.section.B.1.p.1">The "Content-Disposition" response-header field has been proposed as a means for the origin server to suggest a default filename1786 if the user requests that the content is saved to a file. This usage is derived from the definition of Content-Disposition1787 in <a href="#RFC2183" id="rfc.xref.RFC2183.3"><cite title="Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field">[RFC2183]</cite></a>.1788 </p>1789 <div id="rfc.figure.u.36"></div><pre class="inline"><span id="rfc.iref.g.36"></span><span id="rfc.iref.g.37"></span><span id="rfc.iref.g.38"></span><span id="rfc.iref.g.39"></span><span id="rfc.iref.g.40"></span><span id="rfc.iref.g.41"></span><span id="rfc.iref.g.42"></span> <a href="#content-disposition" class="smpl">content-disposition</a> = "Content-Disposition" ":" <a href="#core.rules" class="smpl">OWS</a>1790 <a href="#content-disposition" class="smpl">content-disposition-v</a>1791 <a href="#content-disposition" class="smpl">content-disposition-v</a> = <a href="#content-disposition" class="smpl">disposition-type</a>1792 *( <a href="#core.rules" class="smpl">OWS</a> ";" <a href="#core.rules" class="smpl">OWS</a> <a href="#content-disposition" class="smpl">disposition-parm</a> )1793 <a href="#content-disposition" class="smpl">disposition-type</a> = "attachment" / <a href="#content-disposition" class="smpl">disp-extension-token</a>1794 <a href="#content-disposition" class="smpl">disposition-parm</a> = <a href="#content-disposition" class="smpl">filename-parm</a> / <a href="#content-disposition" class="smpl">disp-extension-parm</a>1795 <a href="#content-disposition" class="smpl">filename-parm</a> = "filename" "=" <a href="#core.rules" class="smpl">quoted-string</a>1796 <a href="#content-disposition" class="smpl">disp-extension-token</a> = <a href="#core.rules" class="smpl">token</a>1797 <a href="#content-disposition" class="smpl">disp-extension-parm</a> = <a href="#core.rules" class="smpl">token</a> "=" <a href="#core.rules" class="smpl">word</a>1798 </pre><p id="rfc.section.B.1.p.3">An example is</p>1799 <div id="rfc.figure.u.37"></div><pre class="text"> Content-Disposition: attachment; filename="fname.ext"1800 </pre><p id="rfc.section.B.1.p.5">The receiving user agent <em class="bcp14">SHOULD NOT</em> respect any directory path information present in the filename-parm parameter, which is the only parameter believed to apply1801 to HTTP implementations at this time. The filename <em class="bcp14">SHOULD</em> be treated as a terminal component only.1802 </p>1803 <p id="rfc.section.B.1.p.6">If this header is used in a response with the application/octet-stream content-type, the implied suggestion is that the user1804 agent should not display the response, but directly enter a "save response as..." dialog.1805 </p>1806 <p id="rfc.section.B.1.p.7">See <a href="#content-disposition.issues" title="Content-Disposition Issues">Section 8.2</a> for Content-Disposition security issues.1807 </p>1808 1761 <h1 id="rfc.section.C"><a href="#rfc.section.C">C.</a> <a id="changes.from.rfc.2616" href="#changes.from.rfc.2616">Changes from RFC 2616</a></h1> 1809 1762 <p id="rfc.section.C.p.1">Clarify contexts that charset is used in. (<a href="#character.sets" title="Character Sets">Section 2.1</a>) … … 1816 1769 </p> 1817 1770 <h1 id="rfc.section.D"><a href="#rfc.section.D">D.</a> <a id="collected.abnf" href="#collected.abnf">Collected ABNF</a></h1> 1818 <div id="rfc.figure.u.3 8"></div> <pre class="inline"><a href="#header.accept" class="smpl">Accept</a> = "Accept:" OWS Accept-v1771 <div id="rfc.figure.u.36"></div> <pre class="inline"><a href="#header.accept" class="smpl">Accept</a> = "Accept:" OWS Accept-v 1819 1772 <a href="#header.accept-charset" class="smpl">Accept-Charset</a> = "Accept-Charset:" OWS Accept-Charset-v 1820 1773 <a href="#header.accept-charset" class="smpl">Accept-Charset-v</a> = *( "," OWS ) ( charset / "*" ) [ OWS ";" OWS "q=" … … 1863 1816 <a href="#header.accept-encoding" class="smpl">codings</a> = ( content-coding / "*" ) 1864 1817 <a href="#content.codings" class="smpl">content-coding</a> = token 1865 <a href="#content-disposition" class="smpl">content-disposition</a> = "Content-Disposition:" OWS1866 content-disposition-v1867 <a href="#content-disposition" class="smpl">content-disposition-v</a> = disposition-type *( OWS ";" OWS1868 disposition-parm )1869 1870 <a href="#content-disposition" class="smpl">disp-extension-parm</a> = token "=" word1871 <a href="#content-disposition" class="smpl">disp-extension-token</a> = token1872 <a href="#content-disposition" class="smpl">disposition-parm</a> = filename-parm / disp-extension-parm1873 <a href="#content-disposition" class="smpl">disposition-type</a> = "attachment" / disp-extension-token1874 1875 <a href="#content-disposition" class="smpl">filename-parm</a> = "filename=" quoted-string1876 1818 1877 1819 <a href="#header.accept-language" class="smpl">language-range</a> = <language-range, defined in [RFC4647], Section 2.1> … … 1885 1827 <a href="#abnf.dependencies" class="smpl">partial-URI</a> = <partial-URI, defined in [Part1], Section 2.6> 1886 1828 1887 <a href="#core.rules" class="smpl">quoted-string</a> = <quoted-string, defined in [Part1], Section 1.2.2>1888 1829 <a href="#abnf.dependencies" class="smpl">qvalue</a> = <qvalue, defined in [Part1], Section 6.4> 1889 1830 … … 1896 1837 1897 1838 <a href="#core.rules" class="smpl">word</a> = <word, defined in [Part1], Section 1.2.2> 1898 </pre> <div id="rfc.figure.u.3 9"></div>1839 </pre> <div id="rfc.figure.u.37"></div> 1899 1840 <p>ABNF diagnostics:</p><pre class="inline">; Accept defined but not used 1900 1841 ; Accept-Charset defined but not used … … 1911 1852 ; Last-Modified defined but not used 1912 1853 ; MIME-Version defined but not used 1913 ; content-disposition defined but not used1914 1854 </pre><h1 id="rfc.section.E"><a href="#rfc.section.E">E.</a> <a id="change.log" href="#change.log">Change Log (to be removed by RFC Editor before publication)</a></h1> 1915 1855 <h2 id="rfc.section.E.1"><a href="#rfc.section.E.1">E.1</a> Since RFC2616 … … 2091 2031 </ul> 2092 2032 <h2 id="rfc.section.E.13"><a href="#rfc.section.E.13">E.13</a> <a id="changes.since.11" href="#changes.since.11">Since draft-ietf-httpbis-p3-payload-11</a></h2> 2093 <p id="rfc.section.E.13.p.1">None yet.</p> 2033 <p id="rfc.section.E.13.p.1">Closed issues: </p> 2034 <ul> 2035 <li> <<a href="http://tools.ietf.org/wg/httpbis/trac/ticket/123">http://tools.ietf.org/wg/httpbis/trac/ticket/123</a>>: "Factor out Content-Disposition" 2036 </li> 2037 </ul> 2094 2038 <h1 id="rfc.index"><a href="#rfc.index">Index</a></h1> 2095 2039 <p class="noprint"><a href="#rfc.index.A">A</a> <a href="#rfc.index.B">B</a> <a href="#rfc.index.C">C</a> <a href="#rfc.index.D">D</a> <a href="#rfc.index.G">G</a> <a href="#rfc.index.H">H</a> <a href="#rfc.index.I">I</a> <a href="#rfc.index.M">M</a> <a href="#rfc.index.P">P</a> <a href="#rfc.index.R">R</a> … … 2119 2063 <li class="indline1">compress (Coding Format) <a class="iref" href="#rfc.iref.c.2">2.2</a></li> 2120 2064 <li class="indline1">content negotiation <a class="iref" href="#rfc.iref.c.1">1.1</a></li> 2121 <li class="indline1">Content-Disposition header <a class="iref" href="#rfc.xref.content-disposition.1">7.1</a>, <a class="iref" href="#rfc.xref.content-disposition.2">8.2</a>, <a class="iref" href="#rfc.iref.c.12"><b>B.1</b></a>, <a class="iref" href="#rfc.extref.c.32">B.1</a>, <a class="iref" href="#rfc.extref.c.50">D</a></li>2122 2065 <li class="indline1">Content-Encoding header <a class="iref" href="#rfc.xref.header.content-encoding.1">2.2</a>, <a class="iref" href="#rfc.xref.header.content-encoding.2">4.1</a>, <a class="iref" href="#rfc.iref.c.7"><b>6.5</b></a>, <a class="iref" href="#rfc.xref.header.content-encoding.3">6.5</a>, <a class="iref" href="#rfc.xref.header.content-encoding.4">7.1</a></li> 2123 2066 <li class="indline1">Content-Language header <a class="iref" href="#rfc.xref.header.content-language.1">4.1</a>, <a class="iref" href="#rfc.iref.c.8"><b>6.6</b></a>, <a class="iref" href="#rfc.xref.header.content-language.2">7.1</a></li> … … 2148 2091 <li class="indline1"><tt>codings</tt> <a class="iref" href="#rfc.iref.g.20"><b>6.3</b></a></li> 2149 2092 <li class="indline1"><tt>content-coding</tt> <a class="iref" href="#rfc.iref.g.2"><b>2.2</b></a></li> 2150 <li class="indline1"><tt>content-disposition</tt> <a class="iref" href="#rfc.iref.g.36"><b>B.1</b></a></li>2151 <li class="indline1"><tt>content-disposition-v</tt> <a class="iref" href="#rfc.iref.g.37"><b>B.1</b></a></li>2152 2093 <li class="indline1"><tt>Content-Encoding</tt> <a class="iref" href="#rfc.iref.g.24"><b>6.5</b></a></li> 2153 2094 <li class="indline1"><tt>Content-Encoding-v</tt> <a class="iref" href="#rfc.iref.g.25"><b>6.5</b></a></li> … … 2160 2101 <li class="indline1"><tt>Content-Type</tt> <a class="iref" href="#rfc.iref.g.32"><b>6.9</b></a></li> 2161 2102 <li class="indline1"><tt>Content-Type-v</tt> <a class="iref" href="#rfc.iref.g.33"><b>6.9</b></a></li> 2162 <li class="indline1"><tt>disp-extension-parm</tt> <a class="iref" href="#rfc.iref.g.42"><b>B.1</b></a></li>2163 <li class="indline1"><tt>disp-extension-token</tt> <a class="iref" href="#rfc.iref.g.41"><b>B.1</b></a></li>2164 <li class="indline1"><tt>disposition-parm</tt> <a class="iref" href="#rfc.iref.g.39"><b>B.1</b></a></li>2165 <li class="indline1"><tt>disposition-type</tt> <a class="iref" href="#rfc.iref.g.38"><b>B.1</b></a></li>2166 <li class="indline1"><tt>filename-parm</tt> <a class="iref" href="#rfc.iref.g.40"><b>B.1</b></a></li>2167 2103 <li class="indline1"><tt>language-range</tt> <a class="iref" href="#rfc.iref.g.23"><b>6.4</b></a></li> 2168 2104 <li class="indline1"><tt>language-tag</tt> <a class="iref" href="#rfc.iref.g.10"><b>2.4</b></a></li> … … 2187 2123 <li class="indline1">Accept-Encoding <a class="iref" href="#rfc.xref.header.accept-encoding.1">2.2</a>, <a class="iref" href="#rfc.xref.header.accept-encoding.2">5.1</a>, <a class="iref" href="#rfc.iref.h.3"><b>6.3</b></a>, <a class="iref" href="#rfc.xref.header.accept-encoding.3">7.1</a></li> 2188 2124 <li class="indline1">Accept-Language <a class="iref" href="#rfc.xref.header.accept-language.1">5.1</a>, <a class="iref" href="#rfc.iref.h.4"><b>6.4</b></a>, <a class="iref" href="#rfc.xref.header.accept-language.2">7.1</a></li> 2189 <li class="indline1">Content-Disposition <a class="iref" href="#rfc.xref.content-disposition.1">7.1</a>, <a class="iref" href="#rfc.xref.content-disposition.2">8.2</a>, <a class="iref" href="#rfc.iref.h.11"><b>B.1</b></a>, <a class="iref" href="#rfc.extref.c.32">B.1</a>, <a class="iref" href="#rfc.extref.c.50">D</a></li>2190 2125 <li class="indline1">Content-Encoding <a class="iref" href="#rfc.xref.header.content-encoding.1">2.2</a>, <a class="iref" href="#rfc.xref.header.content-encoding.2">4.1</a>, <a class="iref" href="#rfc.iref.h.5"><b>6.5</b></a>, <a class="iref" href="#rfc.xref.header.content-encoding.3">6.5</a>, <a class="iref" href="#rfc.xref.header.content-encoding.4">7.1</a></li> 2191 2126 <li class="indline1">Content-Language <a class="iref" href="#rfc.xref.header.content-language.1">4.1</a>, <a class="iref" href="#rfc.iref.h.6"><b>6.6</b></a>, <a class="iref" href="#rfc.xref.header.content-language.2">7.1</a></li> … … 2208 2143 </li> 2209 2144 <li class="indline0"><a id="rfc.index.P" href="#rfc.index.P"><b>P</b></a><ul class="ind"> 2210 <li class="indline1"><em>Part1</em> <a class="iref" href="#rfc.xref.Part1.1">1.3</a>, <a class="iref" href="#rfc.xref.Part1.2">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.3">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.4">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.5">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.6">1.3. 1</a>, <a class="iref" href="#rfc.xref.Part1.7">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.8">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.9">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.10">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.11">2.2</a>, <a class="iref" href="#rfc.xref.Part1.12">2.2</a>, <a class="iref" href="#rfc.xref.Part1.13">2.2</a>, <a class="iref" href="#rfc.xref.Part1.14">2.2.1</a>, <a class="iref" href="#rfc.xref.Part1.15">2.2.1</a>, <a class="iref" href="#rfc.xref.Part1.16">3.1</a>, <a class="iref" href="#rfc.xref.Part1.17">3.2</a>, <a class="iref" href="#rfc.xref.Part1.18">6.1</a>, <a class="iref" href="#rfc.xref.Part1.19">6.3</a>, <a class="iref" href="#rfc.xref.Part1.20">6.7</a>, <a class="iref" href="#rfc.xref.Part1.21">7.2</a>, <a class="iref" href="#rfc.xref.Part1.22">7.2</a>, <a class="iref" href="#rfc.xref.Part1.23">7.2</a>, <a class="iref" href="#Part1"><b>10.1</b></a>, <a class="iref" href="#rfc.xref.Part1.24">A.3</a>, <a class="iref" href="#rfc.xref.Part1.25">A.6</a><ul class="ind">2145 <li class="indline1"><em>Part1</em> <a class="iref" href="#rfc.xref.Part1.1">1.3</a>, <a class="iref" href="#rfc.xref.Part1.2">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.3">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.4">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.5">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.6">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.7">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.8">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.9">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.10">2.2</a>, <a class="iref" href="#rfc.xref.Part1.11">2.2</a>, <a class="iref" href="#rfc.xref.Part1.12">2.2</a>, <a class="iref" href="#rfc.xref.Part1.13">2.2.1</a>, <a class="iref" href="#rfc.xref.Part1.14">2.2.1</a>, <a class="iref" href="#rfc.xref.Part1.15">3.1</a>, <a class="iref" href="#rfc.xref.Part1.16">3.2</a>, <a class="iref" href="#rfc.xref.Part1.17">6.1</a>, <a class="iref" href="#rfc.xref.Part1.18">6.3</a>, <a class="iref" href="#rfc.xref.Part1.19">6.7</a>, <a class="iref" href="#rfc.xref.Part1.20">7.2</a>, <a class="iref" href="#rfc.xref.Part1.21">7.2</a>, <a class="iref" href="#rfc.xref.Part1.22">7.2</a>, <a class="iref" href="#Part1"><b>10.1</b></a>, <a class="iref" href="#rfc.xref.Part1.23">A.3</a>, <a class="iref" href="#rfc.xref.Part1.24">A.6</a><ul class="ind"> 2211 2146 <li class="indline1"><em>Section 1.2</em> <a class="iref" href="#rfc.xref.Part1.1">1.3</a></li> 2212 <li class="indline1"><em>Section 1.2.2</em> <a class="iref" href="#rfc.xref.Part1.2">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.3">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.4">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.5">1.3.1</a> , <a class="iref" href="#rfc.xref.Part1.6">1.3.1</a></li>2213 <li class="indline1"><em>Section 2.6</em> <a class="iref" href="#rfc.xref.Part1. 7">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.9">1.3.2</a></li>2214 <li class="indline1"><em>Section 3.3</em> <a class="iref" href="#rfc.xref.Part1.1 7">3.2</a></li>2215 <li class="indline1"><em>Section 4.3</em> <a class="iref" href="#rfc.xref.Part1. 20">6.7</a></li>2216 <li class="indline1"><em>Section 6.1</em> <a class="iref" href="#rfc.xref.Part1.2 4">A.3</a></li>2217 <li class="indline1"><em>Section 6.2</em> <a class="iref" href="#rfc.xref.Part1.1 4">2.2.1</a></li>2218 <li class="indline1"><em>Section 6.2.2.1</em> <a class="iref" href="#rfc.xref.Part1.1 1">2.2</a>, <a class="iref" href="#rfc.xref.Part1.21">7.2</a></li>2219 <li class="indline1"><em>Section 6.2.2</em> <a class="iref" href="#rfc.xref.Part1.1 5">2.2.1</a></li>2220 <li class="indline1"><em>Section 6.2.2.2</em> <a class="iref" href="#rfc.xref.Part1.1 2">2.2</a>, <a class="iref" href="#rfc.xref.Part1.22">7.2</a></li>2221 <li class="indline1"><em>Section 6.2.2.3</em> <a class="iref" href="#rfc.xref.Part1.1 3">2.2</a>, <a class="iref" href="#rfc.xref.Part1.23">7.2</a></li>2222 <li class="indline1"><em>Section 6.4</em> <a class="iref" href="#rfc.xref.Part1. 10">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.18">6.1</a>, <a class="iref" href="#rfc.xref.Part1.19">6.3</a></li>2223 <li class="indline1"><em>Section 9.2</em> <a class="iref" href="#rfc.xref.Part1. 8">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.16">3.1</a></li>2224 <li class="indline1"><em>Section 9.7</em> <a class="iref" href="#rfc.xref.Part1.2 5">A.6</a></li>2147 <li class="indline1"><em>Section 1.2.2</em> <a class="iref" href="#rfc.xref.Part1.2">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.3">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.4">1.3.1</a>, <a class="iref" href="#rfc.xref.Part1.5">1.3.1</a></li> 2148 <li class="indline1"><em>Section 2.6</em> <a class="iref" href="#rfc.xref.Part1.6">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.8">1.3.2</a></li> 2149 <li class="indline1"><em>Section 3.3</em> <a class="iref" href="#rfc.xref.Part1.16">3.2</a></li> 2150 <li class="indline1"><em>Section 4.3</em> <a class="iref" href="#rfc.xref.Part1.19">6.7</a></li> 2151 <li class="indline1"><em>Section 6.1</em> <a class="iref" href="#rfc.xref.Part1.23">A.3</a></li> 2152 <li class="indline1"><em>Section 6.2</em> <a class="iref" href="#rfc.xref.Part1.13">2.2.1</a></li> 2153 <li class="indline1"><em>Section 6.2.2.1</em> <a class="iref" href="#rfc.xref.Part1.10">2.2</a>, <a class="iref" href="#rfc.xref.Part1.20">7.2</a></li> 2154 <li class="indline1"><em>Section 6.2.2</em> <a class="iref" href="#rfc.xref.Part1.14">2.2.1</a></li> 2155 <li class="indline1"><em>Section 6.2.2.2</em> <a class="iref" href="#rfc.xref.Part1.11">2.2</a>, <a class="iref" href="#rfc.xref.Part1.21">7.2</a></li> 2156 <li class="indline1"><em>Section 6.2.2.3</em> <a class="iref" href="#rfc.xref.Part1.12">2.2</a>, <a class="iref" href="#rfc.xref.Part1.22">7.2</a></li> 2157 <li class="indline1"><em>Section 6.4</em> <a class="iref" href="#rfc.xref.Part1.9">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.17">6.1</a>, <a class="iref" href="#rfc.xref.Part1.18">6.3</a></li> 2158 <li class="indline1"><em>Section 9.2</em> <a class="iref" href="#rfc.xref.Part1.7">1.3.2</a>, <a class="iref" href="#rfc.xref.Part1.15">3.1</a></li> 2159 <li class="indline1"><em>Section 9.7</em> <a class="iref" href="#rfc.xref.Part1.24">A.6</a></li> 2225 2160 </ul> 2226 2161 </li> … … 2265 2200 <li class="indline1"><em>RFC2076</em> <a class="iref" href="#RFC2076"><b>10.2</b></a>, <a class="iref" href="#rfc.xref.RFC2076.1">B</a></li> 2266 2201 <li class="indline1"><em>RFC2119</em> <a class="iref" href="#rfc.xref.RFC2119.1">1.2</a>, <a class="iref" href="#RFC2119"><b>10.1</b></a></li> 2267 <li class="indline1"><em>RFC2183</em> <a class="iref" href="#rfc.xref.RFC2183.1">8.2</a>, <a class="iref" href="#rfc.xref.RFC2183.2">8.2</a>, <a class="iref" href="#RFC2183"><b>10.2</b></a>, <a class="iref" href="#rfc.xref.RFC2183.3">B.1</a><ul class="ind">2268 <li class="indline1"><em>Section 5</em> <a class="iref" href="#rfc.xref.RFC2183.2">8.2</a></li>2269 </ul>2270 </li>2271 2202 <li class="indline1"><em>RFC2277</em> <a class="iref" href="#rfc.xref.RFC2277.1">2.1</a>, <a class="iref" href="#RFC2277"><b>10.2</b></a></li> 2272 2203 <li class="indline1"><em>RFC2295</em> <a class="iref" href="#rfc.xref.RFC2295.1">5</a>, <a class="iref" href="#RFC2295"><b>10.2</b></a></li> -
draft-ietf-httpbis/latest/p3-payload.xml
r981 r987 304 304 305 305 <section title="Core Rules" anchor="core.rules"> 306 <x:anchor-alias value="quoted-string"/>307 306 <x:anchor-alias value="token"/> 308 307 <x:anchor-alias value="word"/> … … 312 311 </t> 313 312 <figure><artwork type="abnf2616"> 314 <x:ref>quoted-string</x:ref> = <quoted-string, defined in &basic-rules;>315 313 <x:ref>token</x:ref> = <token, defined in &basic-rules;> 316 314 <x:ref>word</x:ref> = <word, defined in &basic-rules;> … … 1638 1636 <c> 1639 1637 <xref target="header.accept-language"/> 1640 </c>1641 <c>Content-Disposition</c>1642 <c>http</c>1643 <c>standard</c>1644 <c>1645 <xref target="content-disposition"/>1646 1638 </c> 1647 1639 <c>Content-Encoding</c> … … 1777 1769 </section> 1778 1770 1779 <section title="Content-Disposition Issues" anchor="content-disposition.issues">1780 <t>1781 <xref target="RFC2183"/>, from which the often implemented Content-Disposition1782 (see <xref target="content-disposition"/>) header in HTTP is derived, has a number of very1783 serious security considerations. Content-Disposition is not part of1784 the HTTP standard, but since it is widely implemented, we are1785 documenting its use and risks for implementors. See <xref target="RFC2183" x:fmt="of" x:sec="5"/>1786 for details.1787 </t>1788 </section>1789 1790 1771 </section> 1791 1772 … … 2304 2285 </reference> 2305 2286 2306 <reference anchor="RFC2183">2307 <front>2308 <title abbrev="Content-Disposition">Communicating Presentation Information in Internet Messages: The Content-Disposition Header Field</title>2309 <author initials="R." surname="Troost" fullname="Rens Troost">2310 <organization>New Century Systems</organization>2311 <address><email>rens@century.com</email></address>2312 </author>2313 <author initials="S." surname="Dorner" fullname="Steve Dorner">2314 <organization>QUALCOMM Incorporated</organization>2315 <address><email>sdorner@qualcomm.com</email></address>2316 </author>2317 <author initials="K." surname="Moore" fullname="Keith Moore">2318 <organization>Department of Computer Science</organization>2319 <address><email>moore@cs.utk.edu</email></address>2320 </author>2321 <date month="August" year="1997"/>2322 </front>2323 <seriesInfo name="RFC" value="2183"/>2324 </reference>2325 2326 2287 <reference anchor="RFC2277"> 2327 2288 <front> … … 2689 2650 from SMTP and MIME are also often implemented (see <xref target="RFC2076"/>). 2690 2651 </t> 2691 2692 <section title="Content-Disposition" anchor="content-disposition">2693 <iref item="Headers" subitem="Content-Disposition" primary="true" x:for-anchor=""/>2694 <iref item="Content-Disposition header" primary="true" x:for-anchor=""/>2695 <x:anchor-alias value="content-disposition"/>2696 <x:anchor-alias value="content-disposition-v"/>2697 <x:anchor-alias value="disposition-type"/>2698 <x:anchor-alias value="disposition-parm"/>2699 <x:anchor-alias value="disp-extension-parm"/>2700 <x:anchor-alias value="disp-extension-token"/>2701 <x:anchor-alias value="filename-parm"/>2702 <t>2703 The "Content-Disposition" response-header field has been proposed as a2704 means for the origin server to suggest a default filename if the user2705 requests that the content is saved to a file. This usage is derived2706 from the definition of Content-Disposition in <xref target="RFC2183"/>.2707 </t>2708 <figure><artwork type="abnf2616"><iref primary="true" item="Grammar" subitem="content-disposition"/><iref primary="true" item="Grammar" subitem="content-disposition-v"/><iref primary="true" item="Grammar" subitem="disposition-type"/><iref primary="true" item="Grammar" subitem="disposition-parm"/><iref primary="true" item="Grammar" subitem="filename-parm"/><iref primary="true" item="Grammar" subitem="disp-extension-token"/><iref primary="true" item="Grammar" subitem="disp-extension-parm"/>2709 <x:ref>content-disposition</x:ref> = "Content-Disposition" ":" <x:ref>OWS</x:ref>2710 <x:ref>content-disposition-v</x:ref>2711 <x:ref>content-disposition-v</x:ref> = <x:ref>disposition-type</x:ref>2712 *( <x:ref>OWS</x:ref> ";" <x:ref>OWS</x:ref> <x:ref>disposition-parm</x:ref> )2713 <x:ref>disposition-type</x:ref> = "attachment" / <x:ref>disp-extension-token</x:ref>2714 <x:ref>disposition-parm</x:ref> = <x:ref>filename-parm</x:ref> / <x:ref>disp-extension-parm</x:ref>2715 <x:ref>filename-parm</x:ref> = "filename" "=" <x:ref>quoted-string</x:ref>2716 <x:ref>disp-extension-token</x:ref> = <x:ref>token</x:ref>2717 <x:ref>disp-extension-parm</x:ref> = <x:ref>token</x:ref> "=" <x:ref>word</x:ref>2718 </artwork></figure>2719 <t>2720 An example is2721 </t>2722 <figure><artwork type="example">2723 Content-Disposition: attachment; filename="fname.ext"2724 </artwork></figure>2725 <t>2726 The receiving user agent &SHOULD-NOT; respect any directory path2727 information present in the filename-parm parameter, which is the only2728 parameter believed to apply to HTTP implementations at this time. The2729 filename &SHOULD; be treated as a terminal component only.2730 </t>2731 <t>2732 If this header is used in a response with the application/octet-stream2733 content-type, the implied suggestion is that the user agent2734 should not display the response, but directly enter a "save response2735 as..." dialog.2736 </t>2737 <t>2738 See <xref target="content-disposition.issues"/> for Content-Disposition security issues.2739 </t>2740 </section>2741 2652 </section> 2742 2653 … … 2810 2721 <x:ref>codings</x:ref> = ( content-coding / "*" ) 2811 2722 <x:ref>content-coding</x:ref> = token 2812 <x:ref>content-disposition</x:ref> = "Content-Disposition:" OWS2813 content-disposition-v2814 <x:ref>content-disposition-v</x:ref> = disposition-type *( OWS ";" OWS2815 disposition-parm )2816 2817 <x:ref>disp-extension-parm</x:ref> = token "=" word2818 <x:ref>disp-extension-token</x:ref> = token2819 <x:ref>disposition-parm</x:ref> = filename-parm / disp-extension-parm2820 <x:ref>disposition-type</x:ref> = "attachment" / disp-extension-token2821 2822 <x:ref>filename-parm</x:ref> = "filename=" quoted-string2823 2723 2824 2724 <x:ref>language-range</x:ref> = <language-range, defined in [RFC4647], Section 2.1> … … 2832 2732 <x:ref>partial-URI</x:ref> = <partial-URI, defined in [Part1], Section 2.6> 2833 2733 2834 <x:ref>quoted-string</x:ref> = <quoted-string, defined in [Part1], Section 1.2.2>2835 2734 <x:ref>qvalue</x:ref> = <qvalue, defined in [Part1], Section 6.4> 2836 2735 … … 2860 2759 ; Last-Modified defined but not used 2861 2760 ; MIME-Version defined but not used 2862 ; content-disposition defined but not used2863 2761 </artwork></figure></section> 2864 2762 <?ENDINC p3-payload.abnf-appendix ?> … … 3216 3114 <section title="Since draft-ietf-httpbis-p3-payload-11" anchor="changes.since.11"> 3217 3115 <t> 3218 None yet. 3116 Closed issues: 3117 <list style="symbols"> 3118 <t> 3119 <eref target="http://tools.ietf.org/wg/httpbis/trac/ticket/123"/>: 3120 "Factor out Content-Disposition" 3121 </t> 3122 </list> 3219 3123 </t> 3220 3124 </section>
Note: See TracChangeset
for help on using the changeset viewer.
