IE cannot download files over SSL served by WebSphere

Question

IE 7 & 8 both throw an error when users attempt to download a csv file over https.

Internet Explorer cannot download downloadPage.jsf. Internet Explorer was not able to open this internet site. The requested site is either unavailable or cannot be found. Please try again

I read about the issues IE has in relation to caching so I changed the response to allow public caching. See this issue: IE cannot download foo.jsf. IE was not able to open this internet site. The requested site is either unavailable or cannot be found

response.setHeader("Pragma", "public");
response.setHeader("Cache-Control", "public");

But I am still getting this error.

Any ideas what else could be causing the issue? Here's the complete snippet:

HttpServletResponse response = (HttpServletResponse) context.getExternalContext().getResponse();
response.setContentType("text/plain");
response.setHeader("Content-Disposition", "attachment; filename=\"" + browserFilename + "\"");
response.setHeader("Pragma", "public");
response.setHeader("Cache-Control", "public");
response.getOutputStream().write(contentBytes);
context.responseComplete();

I'm not sure at the moment, having problems with the application on non-ssl mode. — Thomas Buckley, Jul 05 '11 at 14:57
This post helped me out so much. Thanks to everyone who contributed! — Matt, Apr 20 '12 at 15:25

score 9 · Accepted Answer · edited Feb 11 '15 at 12:09

9

It appears that WebSphere automatically adds Cache-Control:no-cache=set-cookie response header when cookies are included in the response. IE8 & older do not like this when downloading over SSL.

There are two possible fixes as per this IBM Developerworks forum thread:

Add the custom response header CookiesConfigureNoCache:false for HTTP transport Channel in WebSphere (it's true by default).
```
response.setHeader("CookiesConfigureNoCache", "false");             
```
Explicitly set the Cache-Control header after cookies are being added, this will override the WebSphere-set one.
```
response.addCookie(...);
response.addCookie(...);
...
response.setHeader("Cache-Control", ...);
```

edited Feb 11 '15 at 12:09

BalusC

1,082,665
372
3,610
3,555

answered Jul 06 '11 at 17:00

Thomas Buckley

5,836
19
62
110

What do you mean by Set the 'Cache-Control' header after all cookie processing is complete? How do I know all cookie processing is over? Can I do it in servlet? – webdev Oct 10 '13 at 18:33
@webdev - Yes, at the servlet level. – Thomas Buckley Oct 10 '13 at 20:04
m sorry not sure how do I know cookie processing is over? – webdev Oct 10 '13 at 20:22

score 4 · Answer 2 · answered Jan 19 '12 at 07:39

4

I had the same issue with IE8. I made small changes to my code.

Response.ClearHeaders(); //needed, otherwise "no-cache: set-cookie" was there, had to get rid of it

Response.addHeader("Cache-Control", "private");

answered Jan 19 '12 at 07:39

Shari

49
1
1

score 2 · Answer 3 · answered Feb 27 '12 at 19:07

Had the exact same issue when the app server was configured to use SSL. The trick for me to get it working after the https was turned on:

   string attachment = "attachment; filename=" + rptName + ".xls" + "";    

    HttpContext.Current.Response.Clear();
    HttpContext.Current.Response.ClearHeaders();
    HttpContext.Current.Response.AddHeader("content-disposition", attachment);
    HttpContext.Current.Response.AddHeader("Cache-Control", "private, max-age=1");

    HttpContext.Current.Response.ContentType = "application/vnd.ms-excel";

    HttpContext.Current.Response.Charset = "";
    HttpContext.Current.Response.Buffer = true;
    HttpContext.Current.Response.Cache.SetExpires(DateTime.Now.AddMinutes(1));

Brian, thanks for you post. I changed my file download logic to match yours and it now works for the IE8 client that was having an issue. I'm not sure exactly what line/lines of code made the difference, but anyway, thanks! — , Aug 30 '13 at 19:54

score 1 · Answer 4 · edited May 23 '17 at 10:34

1

I think you are on the right track with caching:

This knowledge base article may help you, Internet Explorer is unable to open Office documents from an SSL Web site

Mentioned in this Stack Overflow question: Cannot open xls file in IE

edited May 23 '17 at 10:34

Community

1
1

answered Jul 04 '11 at 15:45

Alex KeySmith

16,657
11
74
152

Still no luck. I've tried all sorts of combinations in the response header. It is working fine in a previous version of the application. The only diffenrce is the presence of 2 Set-Cookie items in the response as well as 'Cache-Control: no-cache=set-cookie'. Could this no-cache=set-cookie value be causing problems? – Thomas Buckley Jul 05 '11 at 15:47
I wasn't sure on "Cache-Control: no-cache=set-cookie". But looking at http://palisade.plynt.com/issues/2007Mar/internet-cookies/ (the section titled: Do cookies also get stored in caches?) I don't think it should cause any problems. Could it be to do with custom security settings in IE? Are you running IE on a corporate network with extra restrictions (perhaps try firefox)? – Alex KeySmith Jul 05 '11 at 16:01
Yes it's on a corporate network but works fine in firefox and Chrome and IE9. – Thomas Buckley Jul 05 '11 at 16:16
Also, it's happening for multiple users on the network so wouldnt be any custom IE setting we made ourselves. – Thomas Buckley Jul 05 '11 at 16:17
@Thomas Buckley interesting are you running behind a proxy server? – Alex KeySmith Jul 05 '11 at 16:25
Here is another link which may prove useful (but it pretty much covers the same stuff as the link above): http://support.microsoft.com/kb/323308 – Alex KeySmith Jul 05 '11 at 16:30
Thanks for suggestions and help Alex. It turned out to be a websphere issue...see my added answer. – Thomas Buckley Jul 06 '11 at 16:53
@Thomas Buckley: Glad you got it sorted :-) – Alex KeySmith Jul 07 '11 at 08:23

score 0 · Answer 5 · answered Feb 11 '15 at 11:46

I hade the same problem. After set "Content-Disposition" and "Content-Type", add this code.

Java code

// IE requires these three lines, exactly like this
response.setHeader("CookiesConfigureNoCache", "false");             
response.setHeader("Pragma","private,no-cache");     
response.setHeader("Cache-control","private,no-store,no-cache,max-age=0,must-revalidate");

PHP code

// IE requires these three lines, exactly like this
header("CookiesConfigureNoCache: false");
header("Pragma: private,no-cache");
header("Cache-control: private,no-store,no-cache,max-age=0,must-revalidate");

score -1 · Answer 6 · answered May 19 '14 at 23:28

Here's what I've done in my PHP code:

header( "HTTP/1.0 200 OK" );
header( "Content-Disposition: inline; filename=$path" );
header( "Content-Type: attachment; application/pdf" );
header( "Content-Length: $info[7]" );
header( "Cache-Control: no-store, no-cache" );          // IE 8 requires these two lines, exactly like this
header( "Pragma: private" );                            // IE 8 requires these two lines, exactly like this
readfile( $tmpfile );

IE cannot download files over SSL served by WebSphere

6 Answers6

Linked