@broberg/http
Framework-free HTTP header/response primitives — Node, Bun, and edge, with zero runtime dependencies. Each helper returns a string; you set the header.
npm i @broberg/http
contentDisposition(filename, opts?)
Build a Content-Disposition value that survives non-ASCII filenames (æøå).
A raw non-ASCII byte in this header makes Bun reject it → HTTP 500 on
download. The fix (RFC 5987 / RFC 6266) is to emit both an ASCII
filename="..." fallback (old clients) and a filename*=UTF-8''<pct-encoded>
form (modern clients prefer it) — so the user downloads brændte-filer.pdf with
its real characters instead of a mangled transliteration.
import { contentDisposition } from "@broberg/http";
res.headers.set("Content-Disposition", contentDisposition("brændte-filer.pdf"));
// → attachment; filename="br_ndte-filer.pdf"; filename*=UTF-8''br%C3%A6ndte-filer.pdf
contentDisposition("report.pdf", { disposition: "inline" });
// → inline; filename="report.pdf"; filename*=UTF-8''report.pdf
disposition—"attachment"(default) or"inline".- ASCII fallback — control chars + CR/LF stripped, path separators / non-ASCII
/
"\replaced with_; an empty name becomesdownload. - RFC 5987 form —
encodeURIComponentplus the four attr-char-reserved characters' ( ) *percent-encoded. - Header-injection safe — CR/LF and control characters are always removed.
MIT · part of the @broberg/*
shared-library family.