Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Explicit content-type: multipart/form-data leads to unexpected content-disposition:attachment in the http body #5256

thanhchungbtc opened this issue Apr 17, 2020 · 4 comments


Copy link

thanhchungbtc commented Apr 17, 2020

I did this

curl -X POST -F 'name=foo' -H 'Content-type: multipart/form-data; charset=utf-8' third_party_url

I expected the following

The problem was I am using the above command to send an HTTP request to a third-party. Things work fine until I upgraded curl to the latest version.
After debugging HTTP request, I found that before curl 7.6x, the request body has sent as ofContent-Disposition: form-data

Content-Disposition: form-data; name="name"


while in version 7.6x, it was attachment

Content-Disposition: attachment; name="name"


If I omit the Content-type header, it goes well (both result in Content-Disposition: form-data) but I also lose the ability to set the charset header which is critical for me.

curl/libcurl version

curl 7.64.1 (x86_64-apple-darwin19.0) libcurl/7.64.1 (SecureTransport) LibreSSL/2.8.3 zlib/1.2.11 nghttp2/1.39.2
Release-Date: 2019-03-27
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS GSS-API HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM NTLM_WB SPNEGO SSL UnixSockets

operating system

This problem happens in my AWS EC2 instance but since I can reproduce it in my local machine, I do think it is related to 7.6x version

Darwin myname-MacBook-Pro.local 19.4.0 Darwin Kernel Version 19.4.0: Wed Mar  4 22:28:40 PST 2020; root:xnu-6153.101.6~15/RELEASE_X86_64 x86_64
Copy link

bagder commented Apr 17, 2020

Are you really talking about curl 7.6, released in January 2001?

I'm reading this several times but it's not clear to me: are you saying you think it should be attachment or form-data in the Content-Disposition: line?

For all I can see, the specs are not very clear either way on this.

@bagder bagder added the HTTP label Apr 17, 2020
Copy link

jay commented Apr 17, 2020

It was probably a typo since his reported version is 7.64.1

/cc @monnerat

Copy link

thanhchungbtc commented Apr 17, 2020

@jay Thx
Sorry for my bad explanation.

I'm reading this several times but it's not clear to me: are you saying you think it should be attachment or form-data in the Content-Disposition: line?

Shouldn't it be Content-Disposition: form-data?
It was form-data in 7.4x and 7.5x but suddenly become attachment in 7.6x that broken my api

Copy link

Yes, this is a bug occurring only when Content-Type has parameters.
I'll submit a PR for this in a few minutes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Successfully merging a pull request may close this issue.

4 participants