I have a Java webapp creating a pdf and streaming it back to the browser.
byte[] pdf = report.exportPdfToArray(user); response.setContentType(\"application/pdf
I can't detect a flaw. Did you check the behavior with other browsers/readers?
As of RFC, it is not defined what the client has to do do with the filename information if displayed inline...