Our financial application shows data grids (Oracle Forms), which users can EXPORT. This creates an Excel spreadsheet on the server which is then opened automatically by the browser. This allows the users to have their own spreadsheet copy of what they were viewing in the application.
The spreadsheet is generated in SYLK format, for example:

Content-type: application/vnd.ms-excel

ID;ORACLE
P;FVerdana;M200
P;FVerdana;M200;SB
P;FVerdana;M200;SUB
F;C1;FG0R;SM1
F;C2;FG0G;SM0
F;C3;FF0G;SM0
F;C4;FF0G;SM0
F;C5;FF2G;SM0
F;C6;FG0G;SM0
F;C7;FG0G;SM0
F;C8;FF2G;SM0
F;C9;FF2G;SM0
F;C10;FG0G;SM0
F;C11;FG0G;SM0
F;C12;FG0G;SM0
F;R1;FG0C;SM2
C;Y1;X1;K"eFin"
C;X2;K"Module"
C;X3;K"Usage"
- etc.

This is long-standing source code that has been working satisfactorily for years. Note the leading "Content-type:" setting.

However, some clients are getting messages which they do not like:


This appears to be a mismatch between the file contents, in SYLK format, and the file extension .xls. Note that the filename 'cfxsof.xls' appears to be generated by some layer within the browsing 'stack'; there is a CGI program called cfxsof.exe which 'provides' the generated file to the browser.

How can we ensure a match between the file contents and file extension?
Is there an alternative to the Content-Type setting?
Is there a way of defining a filename to overrule the generated "cfxsof.xls"?

Thank you in advance.