Support / Method

A strict reading, with uncertainty left visible.

HeaderName parses a single HTTP response-header field value. It implements the grammar and filename-selection guidance of RFC 6266, then applies the current extended-value syntax and UTF-8 requirement from RFC 8187.

What is decoded

• filename* is parsed as charset'language'value-chars.
• A non-empty language field is checked against the complete RFC 5646 Language-Tag structure, including private-use and grandfathered forms, without requiring current registry membership.
• UTF-8 is decoded strictly. Malformed percent escapes and invalid UTF-8 are errors.
• ISO-8859-1 is decoded only to expose the historical RFC 5987 compatibility case and is marked unsupported for current production.
• Percent-looking sequences in regular filename stay literal.

What is not promised

• No browser-parity or browser-recovery prediction.
• No multipart/form-data interpretation.
• No claim that an extension, MIME type, suggested name, or reconstructed header makes a payload safe.
• No exhaustive operating-system policy: the filename checks are a compact warning set.

Normative sources

• RFC 6266 — Content-Disposition in HTTP
• RFC 8187 — Charset/Language Encoding in HTTP Field Parameters
• RFC 5646 — Language-Tag syntax referenced by RFC 8187
• RFC 5987 — historical compatibility context