Content-Disposition attachement is one of the hardest things to implement when you have UTF-8 filenames. You have to browser sniff, and even then I have haven't found a good solution.
Does anyone know of a good resource that explains all the edge cases that must be handled?
See [1] for a very comprehensive and up-to-date table of browser support for various encoding schemes. See [2] for browser-specific hacks.
Summary: most modern browsers including IE9 support RFC2231/5987. (Edit: see my other comment in this thread for IE6-8.)
Another option is to leave out the troublesome "filename" parameter altogether and use the last part of the URL to convey the same information, e.g. /files/uploads/2013/<file_id>/filename.ext. After all, most browsers already understand how percent-encoding works in the URL. With today's URL rewriting engines, this shouldn't be too difficult to achieve regardless of how your files are actually organized on disk or which language you use to perform access control. It would be as if the client were requesting a static file.
Thanks. These days it looks like a reasonable solution is to just call the file "download.ext" for anything older than IE9.
When I was trying to implement a solution to this problem years ago, what I thought would take 20 minutes of coding, started to look like a week of research and testing, and I gave up.
In my experience, IE6-8 can handle UTF-8 filenames if (1) the extension is alphanumeric; (2) you percent-encode the rest of the filename, making sure that whitespace is encoded as "%20" rather than "+"; and (3) you put the whole thing between double quotes. Use RFC2231 for all other browsers, although slightly older versions of Chrome and Safari might cause trouble from time to time.
But nowadays I'm so comfortable with just using the URL that the above encoding schemes just feel like unnecessary hassle. HTTP was designed to display the filename in plain sight in the URL, not bury it in a header. Use it as intended and even IE will happily comply.
Does anyone know of a good resource that explains all the edge cases that must be handled?