DevToolsmith

Content-Disposition Header

The Content-Disposition response header tells the browser whether to show a response or download it, and under what file name.

Type
Response header
Category
Content and negotiation
Defined in
RFC 6266

Syntax

Content-Disposition: inline  |  attachment; filename="<name>"; filename*=UTF-8''<encoded name>

How Content-Disposition works

inline (the default) displays the file if the browser can; attachment always downloads it. For file names with spaces or non-ASCII characters, send both filename (an ASCII fallback, quoted) and filename* with UTF-8 percent-encoding; browsers prefer filename*. In multipart form data the same header names each field.

Examples

Force a download
Content-Disposition: attachment; filename="report.pdf"
Non-ASCII file name
Content-Disposition: attachment; filename="Resume.pdf"; filename*=UTF-8''R%C3%A9sum%C3%A9.pdf

Common mistakes

  • Strip quotes, slashes and line breaks from user-supplied names before putting them in this header, to avoid header injection and path tricks.

Check it

curl -sI https://example.com | grep -i '^content-disposition:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

  • Content-Type: states the media type (MIME type) of the body, and for text, its character encoding.
  • Content-Length: gives the size of the body in bytes.
  • X-Content-Type-Options: stops browsers from guessing (“sniffing”) a response’s type instead of trusting Content-Type.

More content and negotiation headers

Content-Encoding , Accept , Accept-Encoding , Accept-Language , Range , Transfer-Encoding .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Content-Disposition header do?

The Content-Disposition response header tells the browser whether to show a response or download it, and under what file name. inline (the default) displays the file if the browser can; attachment always downloads it. For file names with spaces or non-ASCII characters, send both filename (an ASCII fallback, quoted) and filename* with UTF-8 percent-encoding; browsers prefer filename*. In multipart form data the same header names each field.

How do I see the Content-Disposition header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.