`Content-Disposition` decides a filename, and the filename is where a download becomes a write
Content-Disposition decides a filename, and the filename is where a download becomes a write Every browser download ends with a decision about what to call the file and what to do with it. The server communicates that decision in a response header, and the client acts on it without further prompting. Content-Disposition is a small header with a surprisingly long reach: it names the file, it can…
Content-Disposition is a small header that decides both the filename and the download behavior. It communicates this decision in the HTTP response header, and the client follows it without further prompting. This header is crucial because it names the file and can force a download instead of rendering the content. The specifications define two dispositions: inline (suggesting display) and attachment (suggesting saving), both accepting a filename parameter.
RFC 5987 and its successor outline how to encode non-ASCII characters in these parameters. Implementations must handle two parameter forms, an encoding declaration, and a quoting rule, managing cases where clients understand one form but not the other. When a browser downloads a file, it saves it based on the provided filename. This process can become a vulnerability if the application, not the user, writes the file.
Two cases arise: server-side export jobs, where a server derives a filename from a request parameter, and file imports, where uploaded files use the header to derive stored names. An absence of Content-Disposition on download responses can also lead to vulnerabilities. Browsers might render certain content types as HTML, leading to script execution if the filename contains dangerous characters.
To mitigate these risks, servers should sanitize filenames using an allowlist, generate server-generated identifiers for file storage, serve user content from separate origins, and explicitly set Content-Disposition on every download route. Logging the generated filenames alongside request identities aids in tracking and reviewing potential security incidents.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.