Private files download as different name after anonymous user gets redirected

It seems that a patch for this is not necessary. There is a hook_file_download that we can use:

This hook allows modules to enforce permissions on file downloads whenever Drupal is handling file download, as opposed to the web server bypassing Drupal and returning the file from a public directory. Modules can also provide headers to specify information like the file's name or MIME type.

/**
 * Implements hook_file_download().
 */
function hook_file_download($uri) {
  $filename = \Drupal::service('file_system')->basename($uri);
  $disposition = 'attachment; filename="' . $filename . '"';
  return [
    'Content-disposition' => $disposition,
  ];
}

Replace the hook in your function with your custom module name.

I am able to reproduce this issue. The patch does solve the unique scenario with private files, but it should be regarded as a temporary solution. The root issue appears to be in the core PathProcessorFiles, which converts paths like system/files/path/to/private/file.txt to an internal path of system/files?file=path/to/private/file.txt.

Some examples of issues tracking the problem are the following.

• 📌 Simplify private file routing Needs work
• 📌 Use attributes instead of query string in PathProcessorFiles and stop replacing query string in RouteProvider::getRouteCollectionForRequest() Active
• 🐛 Cannot use a / in route parameter Needs work

I think it would be helpful to have a test covering this scenario.