Content-Disposition Filename Parser

When a download saves under a strange name — full of percent signs, or turning into "download" with no extension — the cause is almost always the Content-Disposition header. It carries the suggested name in two formats that coexist: the traditional filename, limited to ASCII, and the RFC 5987 filename*, which declares its encoding and allows accents, Cyrillic or kanji.

Paste the whole header and the page shows which name will be used. When filename* is present it wins — that is the rule browsers follow — and the value appears already decoded, so "relat%C3%B3rio.pdf" reads as "relatório.pdf" again. When only the plain filename exists, that is what shows up, with the quotes stripped.

The practical advice is to send both: a plain filename with an unaccented version for older clients, and filename*=UTF-8''… with the real name. It also pays to check what comes before the name: attachment forces a download, while inline asks the browser to display the content when it knows how. And a filename coming from user input needs sanitising — slashes, quotes and line breaks in a header are a well-known attack vector.