Inline vs Attachment Directives
Content-Disposition: inline instructs the browser to render the file directly in the active tab if a viewer exists (such as the built-in Chrome PDF viewer or image renderer).
Content-Disposition: attachment; filename="annual-report.pdf" instructs the browser to bypass tab display and immediately trigger a file download dialog.
RFC 5987 Internationalized Filenames
Legacy HTTP headers only supported ASCII characters. To support non-ASCII characters (e.g. accented letters, Turkish characters, emojis), use the RFC 5987 standard: `filename*=UTF-8''fatura_%C3%B6rne%C4%9Fi.pdf`.
Step-by-Step Tutorial
Define Proper MIME Content-Type
Set Content-Type: application/pdf for PDFs, image/webp for WebP, and text/csv for CSV exports.
Configure Content-Disposition Header
Add Content-Disposition: attachment; filename="export.csv" to force download behavior.
Prevent MIME Sniffing Vulnerabilities
Always append X-Content-Type-Options: nosniff to stop older browsers from executing malicious scripts uploaded as images.
Ready to Try It Yourself?
DocSwift processes everything directly on your device. Fast, safe, and completely free forever.
How helpful was this guide?
Rated 4.9 / 5 by 3,420+ users worldwide
Share with Colleagues & Friends
Help others protect their document privacy
Frequently Asked Questions
Can client-side JavaScript trigger an attachment download?
Yes! Creating an `<a download="filename.pdf" href="blob:...">` element and calling `.click()` simulates Content-Disposition attachment behavior entirely in frontend code.
What happens if Content-Type is missing?
Browsers attempt to 'sniff' the content by inspecting magic bytes, which can lead to severe Cross-Site Scripting (XSS) security vulnerabilities.