module ActionController::DataStreaming

:doc:
for the +Cache-Control+ header spec.
{RFC 9111}[https://www.rfc-editor.org/rfc/rfc9111.html#name-cache-control]
https://www.mnot.net/cache_docs/ for an overview of web caching and
the server before releasing cached responses. See
by intermediaries. They default to require clients to validate with
The +Pragma+ and +Cache-Control+ headers declare how the file may be cached
Also be aware that the document may be cached by proxies and browsers.

{list of HTTP headers}[https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers].
information to the client. See MDN for a
You can use other Content-* HTTP headers to provide additional

send_file '/path/to/404.html', type: 'text/html; charset=utf-8', disposition: 'inline', status: 404

Show a 404 page in the browser:

send_file '/path/to.jpeg', type: 'image/jpeg', disposition: 'inline'

Show a JPEG in the browser:

send_file '/path/to.zip'

Simple download:

a variety of quirks (especially when downloading over SSL).
possible. IE versions 4, 5, 5.5, and 6 are all known to have
set to download arbitrary binary files in as many browsers as
The default +Content-Type+ and +Content-Disposition+ headers are

(setting :filename overrides this option).
the URL, which is necessary for i18n filenames on certain browsers
* :url_based_filename - set to +true+ if you want the browser to guess the filename from
* :status - specifies the status code to send with the response. Defaults to 200.
Valid values are "inline" and "attachment" (default).
* :disposition - specifies whether the file will be shown inline or downloaded.
If no content type is registered for the extension, the default type +application/octet-stream+ will be used.
If omitted, the type will be inferred from the file extension specified in :filename.
You can specify either a string or a symbol for a registered type with Mime::Type.register, for example +:json+.
* :type - specifies an HTTP content type.
Defaults to File.basename(path).
* :filename - suggests a filename for the browser to use.
Options:

download any file on your server.
page. send_file(params[:path]) allows a malicious user to
Be careful to sanitize the path parameter if it is coming from a web

Your server can also configure this for you by setting the +X-Sendfile-Type+ header.
+config.action_dispatch.x_sendfile_header+.
via the +Rack::Sendfile+ middleware. The header to use is set via
Sends the file. This uses a server-appropriate method (such as +X-Sendfile+)

def send_file(path, options = {}) # :doc:
  raise MissingFile, "Cannot read file #{path}" unless File.file?(path) && File.readable?(path)
  options[:filename] ||= File.basename(path) unless options[:url_based_filename]
  send_file_headers! options
  self.status = options[:status] || 200
  self.content_type = options[:content_type] if options.key?(:content_type)
  response.send_file path
end