Skip to content

The directives in multipart's Content-Disposition are not required to be quoted in RFCs #41683

@Menci

Description

@Menci

MDN URL

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Disposition#as_a_header_for_a_multipart_body

What specific section or headline is this issue about?

As a header for a multipart body

What information was incorrect, unhelpful, or incomplete?

According to MDN's documentation, the values must be quoted. But I can't find the corresponding statements in RFC (both newer RFC 7578 and older RFC 2388).

Since RFC 7578 doesn't have a declaration for the Content-Disposition header, RFC 6266 applies:

4.1. Grammar

  content-disposition = "Content-Disposition" ":"
                         disposition-type *( ";" disposition-parm )

  disposition-type    = "inline" | "attachment" | disp-ext-type
                      ; case-insensitive
  disp-ext-type       = token

  disposition-parm    = filename-parm | disp-ext-parm

  filename-parm       = "filename" "=" value
                      | "filename*" "=" ext-value
  
  disp-ext-parm       = token "=" value
                      | ext-token "=" ext-value
  ext-token           = <the characters in token, followed by "*">

Defined in [RFC2616]:

  token         = <token, defined in [[RFC2616]](https://httpwg.org/specs/rfc6266.html#RFC2616), [Section 2.2](https://www.rfc-editor.org/rfc/rfc2616.html#section-2.2)>
  quoted-string = <quoted-string, defined in [[RFC2616]](https://httpwg.org/specs/rfc6266.html#RFC2616), [Section 2.2](https://www.rfc-editor.org/rfc/rfc2616.html#section-2.2)>
  value         = <value, defined in [[RFC2616]](https://httpwg.org/specs/rfc6266.html#RFC2616), [Section 3.6](https://www.rfc-editor.org/rfc/rfc2616.html#section-3.6)>
                ; token | quoted-string

Defined in [RFC5987]:

  ext-value   = <ext-value, defined in [[RFC5987]](https://httpwg.org/specs/rfc6266.html#RFC5987), [Section 3.2](https://www.rfc-editor.org/rfc/rfc5987.html#section-3.2)>

What did you expect to see?

Through it's not required by the standard, many HTTP server implementations expect the values to be quoted. I think the fact should be pointed out, instead of statementing the quotes to be "required".

Do you have any supporting links, references, or citations?

No response

Do you have anything more you want to share?

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions