Search code examples
httpresponsecontent-disposition

If Content-disposition is not safe to use, what can we use instead?

I've read here that using content-disposition has security issues and is not part of the http standard. If content-disposition, what can we use instead?

I've also searched the list of all response fields categorized whether it is part of the standard or not and I've not seen a response field that can be used to replace content-disposition.

Solution

  • Well, the information about not being a standard is incorrect - see https://greenbytes.de/tech/webdav/rfc6266.html and http://www.iana.org/assignments/message-headers/message-headers.xhtml (note that Wikipedia is entirely irrelevant with respect to this).