Content-Disposition

Suggests whether a response should be displayed inline or downloaded as an attachment.

Use attachment with a safe, explicit filename for downloads and validate untrusted filenames before placing them in a header.

httpdownloadsheader

Reference (http)

Content-Disposition: attachment; filename="report.pdf"

Use attachment with a safe, explicit filename for downloads and validate untrusted filenames before placing them in a header.

Common mistakes

Reflecting untrusted input directly into filename without sanitizing quotes, controls, or path separators.

IANA registry: http-fields/field-names

Sources