Content-DispositionContent-Disposition tells the browser whether to display the response body inline in the page or handle it as a download (attachment). For downloads it can also suggest a filename for the save dialog.
It is also used as a per-part header in multipart/form-data to indicate the form field name and uploaded filename.
attachment; filename="report.pdf" makes the browser handle the content as a download regardless of content type and suggests report.pdf as the default save name. inline shows content in the page when the browser can render it, like PDFs or images.
Non-ASCII filenames are not safely conveyed by filename alone. Providing RFC 5987's filename*=UTF-8''<percent-encoded> lets modern browsers restore Unicode names correctly. For backward compatibility it is customary to supply both an ASCII fallback filename and a Unicode filename*.
Putting a user-supplied name directly into filename is dangerous. Failing to strip or encode newlines, path separators, and quotes can lead to header injection or path manipulation.
Content-Disposition: <inline|attachment>[; filename="..."][; filename*=UTF-8''...]e.g. Content-Disposition: attachment; filename="report.pdf"; filename*=UTF-8''%EB%B3%B4%EA%B3%A0%EC%84%9C.pdf
inline | Lets the browser display the content inline in the page (default disposition). |
attachment | Treats the content as a download, prompting a save dialog. |
filename="<name>" | Suggested filename on save (ASCII). Do not include path or control characters. |
filename*=UTF-8''<pct-encoded> | RFC 5987 encoding for non-ASCII (Unicode) filenames. Needed for international names. |
name="<field>" | Names the form field within a multipart/form-data body. |