application/pdf
applicationThe MIME type for Adobe Portable Document Format files. Browsers with built-in PDF viewers (Chrome, Firefox, Edge) will render PDFs inline; others trigger a download. Use Content-Disposition: attachment to force download instead of inline display.
Details
application/pdf is registered per RFC 8118 (2017, updated from RFC 3778). PDF is specified by ISO 32000.
Browser behavior: - Chrome, Firefox, Edge: render inline in browser PDF viewer - Safari: renders inline if PDF plugin is active - Mobile browsers: behavior varies
Force download: Content-Disposition: attachment;filename="document.pdf" overrides inline rendering.
Content-Disposition: inline; allows browser to decide (usually renders inline).
Security: PDFs can contain JavaScript and embedded content. Serving PDFs from your main domain can be a security risk (PDF JS can access same-origin cookies). Consider serving PDFs from a separate domain or CDN.
Common use
Invoice generation, report downloads, document serving endpoints
Security note
PDFs can execute JavaScript in some viewers. Serve untrusted user-uploaded PDFs from a separate domain to prevent same-origin attacks.