Broken IE8 file download over SSL

Question

I wrote and maintain a site, and two weeks ago Monday March 11th... right after two IE updates and daylight savings time went into effect. This code broke, but only for Windows XP machines running IE8, AND only with SSL encryption. The problem is that I need this file to be transmitted securely. Again this code works with firefox on an XP machine, or IE 9 on Windows 7

The file is created on request and deleted immediately

The problem is not intermittent... it fails consistently.. and quickly ( immediately basically... so there is no timeout issue or something )

here is the error: https://i.stack.imgur.com/fmPnA.png

Here is the current PHP file:

//////////////////
// Download script
//////////////////

$path = $_SERVER['DOCUMENT_ROOT']."/mysite/"; // change the path to fit your websites document structure
$fullPath = $path.$B->LastName.$P->Property_ID.".fnm"; 
if ($fd = fopen ($fullPath, "r")) {
    $fsize = filesize($fullPath);
    $path_parts = pathinfo($fullPath);
    $ext = strtolower($path_parts["extension"]);
    switch ($ext) {
       case "fnm":
        header("Content-type: application/fnm"); // add here more headers for diff. extensions
       header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\""); // use 'attachment' to force a download
        break;
        default;
        header("Content-type: application/octet-stream");
        header("Content-Disposition: filename=\"".$path_parts["basename"]."\"");
    }
    header("Content-length: $fsize");
    header("Cache-control: private"); //use this to open files directly
    while(!feof($fd)) {
        $buffer = fread($fd, 2048);
        echo $buffer;
    }
}
fclose ($fd);

////////////////////////
//Delete the file from the server
/////////////////////////
$myFile = $path.$B->LastName.$P->Property_ID.".fnm"; 
unlink($myFile);

exit;

forcing the default header application/octet-stream... will allow the dialog that says save or open or cancel... but then I get the same error — SmileyHere, Mar 28 '13 at 04:30
actually replacing cache control header with these three lines fixes it completely: — SmileyHere, Mar 28 '13 at 04:36
header("Cache-Control: private, max-age=6000, pre-check=6000"); header("Pragma: private"); header("Expires: " . gmdate("D, d M Y H:i:s"). " GMT"); — SmileyHere, Mar 28 '13 at 04:36
from this page: http://stackoverflow.com/questions/6161864/php-cache-control-doesnt-seem-to-work/6161905 — SmileyHere, Mar 28 '13 at 04:37

score 4 · Answer 1 · answered May 01 '13 at 15:57

When I ran my tests, It seems all that is needed is to have the cache-control to Private, and add the Pragma: private header
Sample Code:

header('Content-Disposition: attachment; filename='.urlencode($zipFileName));
header('Content-Type: application/zip');
header('Content-Length: '.filesize($zipFileName) );
header("Cache-Control: private");
header("Pragma: private");
readfile($zipFileName);

Works like a charm with IE8, over https.

Broken IE8 file download over SSL

1 Answers1