Cyrillic in the Filename parameter of the Content-Disposition header

Question

Nginx

Good afternoon, dear habra-users.

There was a following problem. There is a web application (client in js, server in php) and some kind of file storage. To download a file from storage, the client part of the web application sends a request to the server part, business logic is performed there (checking access rights, etc.), if everything is OK, then a link to the file is given. Then the client side redirects to this link. On the file storage server is nginx, which gives the files. The names of the files are a set of characters without semantic content (just a GUID), which users did not really like. They would like the downloaded file to have the same name as its corresponding entity in the web application. Since renaming files would be very undesirable for some reason, the following was invented:

1. When a link is formed in the server part of a web application, a GET parameter is attached to it, which contains a file name acceptable to the user.
2. In the nginx config, when uploading a file, this parameter is substituted into the Content-Disposition header.
(add_header Content-Disposition 'attachment;Filename=$args';)

Problems started with Russian text substitution in Content-Disposition.
First, firefox urlencodes the links when redirecting to a repository. And nginx substitutes the encoded string in Content-Disposition. Accordingly, firefox offers to save the file also under the encoded name.
Secondly, even if there is an unencoded string in the Content-Disposition, but in UTF-8 with Cyrillic, then IE does not want to know anything about the fact that this is UTF-8. It interprets it as cp1251 and the file name is obtained with krakozyabry.

In general, this scheme works fine only in chrome. If I'm not mistaken, then problem number 1 (urlencode) can be dealt with by rebuilding nginx from source by including the ngx_set_misc module in it. Then in the nginx config it will be possible to use set_unescape_uri to make a urldecode for the file name before inserting it into the Content-Disposition header. But I would like to resort to this option as a last resort.
And how to solve the problem with IE - I don’t know at all.

In general, I'm at an impasse. I would be very grateful for advice, maybe there is a much simpler way to solve my problem, but I don’t see it point-blank.

Answer 1

You cannot use Content-Disposition to set the filename as it only supports Ascii. Solution - use the download links of the form:
/ download / 12345 / Real estate report.xls
And everything will work as it should.

Answer 2

Transliterate Cyrillic into Latin, spaces into underscores.

Answer 3

www.stackoverflow.com/a/7969807

Answer 4

In order for IE to properly understand file names in Russian, I have to do the following feint on the server side.

var fileName = '.....';
var name = isIE(request.headers['user-agent'])? encodeURIComponent(fileName): fileName;
response.set({
     'Content-Type' : contentType,
     'Content-Disposition' : 'attachment; filename="' + name + '"'
});

It is likely that the main thing for you here will be the use of encodeURIComponent

Answer 5

Tested on Chrome 68.0.3440.84 , Firefox 66.0.2, IE
11.648.17134.0