You need to set a Content-Disposition: attachment; filename=.... HTTP header for the browser to use the correct filename.
You can have send_file() set this header for you by setting the as_attachment=True argument. The filename is then taken from the file object you passed in. Use the download_name argument to explicitly set a different filename:
return send_file(os.path.join(filepath, filename), as_attachment=True)
From the flask.send_file documentation:
as_attachment– Indicate to a browser that it should offer to save the file instead of displaying it.download_name– The default name browsers will use when saving the file. Defaults to the passed file name.
Prior to Flask 2.0, download_name was called attachment_filename.
You may want to use the flask.send_from_directory() function instead. That function first ensures that the filename exists (raising a NotFound if not), and ensures that the filename doesn’t contain any .. relative elements that might be used to ‘escape’ the directory. Use this for all filenames taken from untrusted sources:
return send_from_directory(filepath, filename, as_attachment=True)