JSON security warning in IE, tries to download in MVC3 app

Question

I've seen many many questions here on SO during my research regarding to the same problem but none of the answers on any of them have helped me yet.

I've tried each of the answer solutions but none of them worked.

So I'll lay out the code piece by piece and what I've tried and where.

First, my view.. consists of 2 forms and a partial view, the main view here:

@using MyApplication.Select.Web.Helpers; 
@model SearchUsersViewModel

@*Scripts*@







    
        
            
                
                    Welcome to My Application
                
            
        
        
            
        
    
    
        
            
                
                    
                        
                            
                                
                                    @using (Html.BeginForm()) {
                                        @Html.HiddenFor(model => model.SearchFilterType)
                                        
                                            
                                                
                                                    User Search
                                                
                                            
                                        
                                        
                                            
                                                
                                                    Search By User Information
                                                
                                            
                                        
                                        
                                            
                                                
                                            
                                        
                                        
                                            
                                                
                                                    @Html.LabelFor(model => model.LastName)
                                                
                                                
                                                    @Html.TextBoxFor(model => model.LastName, new { @class = "TextField_220" })
                                                
                                            
                                            
                                                
                                                    @Html.LabelFor(model => model.Username)
                                                
                                                
                                                    @Html.TextBoxFor(model => model.Username, new { @class = "TextField_220" })
                                                
                                            
                                            
                                                
                                                    @Html.LabelFor(model => model.EmailAddress)
                                                
                                                
                                                    @Html.TextBoxFor(model => model.EmailAddress, new { @class = "TextField_220" })
                                                
                                            
                                        
                                        
                                            
                                                
                                                
                                                    
                                                        
                                                    
                                                
                                                
                                            
                                        
                                    }
                                
                            
                            
                               
                                
                                    @using (Html.BeginForm()) { 
                                        
                                            
                                                
                                            
                                        
                                        
                                            
                                                
                                                    Search By Entity Information
                                                
                                            
                                        
                                        
                                            
                                                
                                            
                                        
                                        
                                            
                                                
                                                    @Html.LabelFor(model => model.EntityTypeID)
                                                
                                                
                                                    @Html.DropDownListFor(model => model.EntityTypeID, new SelectList(Model.EntityTypes, "ID", "Name"), new { id = "entityTypeDropDown", @class = "DropDown_220" })
                                                
                                            
                                            
                                                
                                                    @Html.LabelFor(model => model.SearchField, new { id = "entityTypeSearchLabel"})
                                                
                                                
                                                    @Html.TextBoxFor(model => model.SearchField, new { id = "entityTypeSearchField", @class = "ui-widget TextField_220" })
                                                
                                            
                                            
                                                
                                                
                                            
                                        
                                        
                                            
                                                
                                                
                                                    
                                                        
                                                    
                                                
                                                
                                            
                                        
                                    }
                                
                            
                        
                    
                
                
                    
                        
                    
                
                
                    
                        
                            
                                
                                    
                                        
                                            User Search Results
                                        
                                        
                                        
                                            
                                                
                                                    
                                                
                                            
                                            
                                                
                                                    
                                                        @*Resend Invitation*@
                                                        
                                                            
                                                                
                                                                
                                                                    = Resend Invitation 
                                                                
                                                            
                                                        
                                                    
                                                    
                                                        @*Account Approved Status*@
                                                        
                                                            
                                                                
                                                                
                                                                    
                                                                        =  
                                                                        Active
                                                                         / 
                                                                        Inactive
                                                                    
                                                                
                                                            
                                                        
                                                    
                                                    
                                                        @*Account Lock Status*@
                                                        
                                                            
                                                                
                                                                
                                                                    = Unlock Account 
                                                                
                                                            
                                                        
                                                    
                                                    
                                                        @*Reset Password*@
                                                        
                                                            
                                                                
                                                                
                                                                    = Reset Password 
                                                                
                                                            
                                                        
                                                    
                                                    
                                                        @*Edit Account*@
                                                        
                                                            
                                                                
                                                                
                                                                    = Edit Account 
                                                                
                                                            
                                                        
                                                    
                                                
                                            
                                            
                                                
                                                    
                                                
                                            
                                        
                                    
                                
                            
                        
                    
                    
                        
                            
                                @Html.Partial("SearchResultsPartial", Model)

SearchResultsPartial is here:

@model SearchUsersViewModel

@*Scripts*@


@(Html.Telerik().Grid(Model.Users)
    .Name("Users").TableHtmlAttributes(new { style = "width: 870px;"})
    .Columns(columns => {
        columns.Bound(o => o.EntityTypeName).Title("Entity Type");
        columns.Bound(o => o.FirstName).Title("First Name");
        columns.Bound(o => o.LastName).Title("Last Name");
        columns.Bound(o => o.Username).Title("Username");
        columns.Template(
            @
                @item.EmailAddress
            ).Title("Email").HtmlAttributes(new { style = "text-align: center" }).HeaderHtmlAttributes(new { style = "text-align: center" });
        columns.Template(
            @
                 @{ if (@item.MembershipID == 0) {
                        
                    }
                    else {
                        if ((bool) item.IsApproved) {
                            
                        }
                        else {
                            
                        }
                        if ((bool) item.IsLockedOut) {
                            
                        }
                        else {
                            
                        }
                        
                    }
                 }
            ).Title("Actions");
        columns.Bound(o => o.RowNumber).Hidden(true);
        columns.Bound(o => o.MembershipID).Hidden(true);
        columns.Bound(o => o.EntityID).Hidden(true);
        columns.Bound(o => o.EntityTypeID).Hidden(true);
    })
)


     Total Rows:
    @{
        if (!@Model.Users.Any()) {
            @Html.Label("0")
        }
        else {
            @Model.Users.First().TotalRows
        } 
    }

Either form can do a search, it's a mutually exclusive search. Search by user data or search by entity data, but not both. The submit button on each form fire off their own javascript which runs an ajax call:

function filterByUserSearch() {

    var lastName = document.getElementById("LastName");
    var username = document.getElementById("Username");
    var emailAddress = document.getElementById("EmailAddress");
    var entityTypeID = document.getElementById("entityTypeDropDown");
    var entityName = document.getElementById("entityTypeSearchField");
    var searchFilterType = document.getElementById("SearchFilterType");

    //alert("User Search");
    entityTypeID.value = 0;
    entityName.value = "";
    searchFilterType.value = 0;
    $.ajax({
        url: "/Admin/Search/",
        dataType: "json",
        cache: false,
        type: 'POST',
        contentType: 'application/json; charset=utf-8',
        data: { LastName: lastName.value, Username: username.value, EmailAddress: emailAddress.value, SearchFilterType: searchFilterType.value },
        success: function (result) {
            $('#resultSpan').html('');
            if(result.Success) {
                $('#searchResults').html(result.Data);
                if (result.ResultMessage != '') {
                    $('#resultSpan').append($("").append(result.ResultMessage)).addClass("AjaxSuccessText");
                    $('#successMsg').css("padding-left", "0");
                    showResultPopUpDiv("ajaxResultWrapperDiv", "Action was Successful!");
                }
            }
            else {
                $('#resultSpan').append($("").append(result.ResultMessage)).addClass("AjaxErrorText");
                $('#errorMsg').css("padding-left", "0");
                showResultPopUpDiv("ajaxResultWrapperDiv", "Ooops! There was an Error");
            }
        }
    });
    return false;
}

The controller action that gets called is here:

[HttpPost]
public JsonResult Search(SearchUsersViewModel model) {
    try {
        if (model.SearchFilterType == SearchFilterType.ByUserData)
            return SearchForUsersByUserData(model, string.Empty);
        if (model.SearchFilterType == SearchFilterType.ByEntityData)
            return SearchForUsersByEntityData(model, string.Empty);
    }
    catch (Exception ex) {
        ModelState.AddModelError("", ModelStateErrorUtility.WrapResultMessageForList(ex.Message));   
    }
    return Json(new { Success = false, ResultMessage = ModelStateErrorUtility.GetModelStateErrors(ModelState) }, "application/json", JsonRequestBehavior.AllowGet);
}

private JsonResult SearchForUsersByUserData(SearchUsersViewModel model, string resultMessage) {
    if (model.LastName != null || model.Username != null || model.EmailAddress != null) {
        var listOfMatchingUsers = SearchUserService.SearchByUserData(model.LastName, model.Username, model.EmailAddress);
        return PrepareSearchResultsForPartialView(model, listOfMatchingUsers, resultMessage);
    }
    throw new ArgumentNullException("Last Name, Username or Email Address must be entered for search");
}

private JsonResult SearchForUsersByEntityData(SearchUsersViewModel model, string resultMessage) {
    if ((model.EntityTypeID == 1) || (model.EntityTypeID > 0 && model.SearchField != null)) {
        var listOfMatchingUsers = SearchUserService.SearchByEntityData(model.EntityTypeID, model.SearchField);
        return PrepareSearchResultsForPartialView(model, listOfMatchingUsers, resultMessage);
    }
    throw new ArgumentNullException("Entity Type must be entered for search");
}

private JsonResult PrepareSearchResultsForPartialView(SearchUsersViewModel model, ICollection list, string resultMessage) {
    return Json(new { Success = true, ResultMessage = ModelStateErrorUtility.WrapResultMessageForList(resultMessage), Data = RenderRazorViewToString("SearchResultsPartial", PrepareSearchResultsForModel(list, model)) }, "application/json", JsonRequestBehavior.AllowGet);
}

private static SearchUsersViewModel PrepareSearchResultsForModel(ICollection listOfMatchingUsers, SearchUsersViewModel model) {
    if (listOfMatchingUsers.Count != 0) {
        model.Users = listOfMatchingUsers.Select(item => new UserEditViewModel(item)).ToList();
    }
    return model;
}

private string RenderRazorViewToString(string viewName, object model) {
    ViewData.Model = model;
    using (var sw = new StringWriter()) {
        var viewResult = ViewEngines.Engines.FindPartialView(ControllerContext, viewName);
        var viewContext = new ViewContext(ControllerContext, viewResult.View, ViewData, TempData, sw);
        viewResult.View.Render(viewContext, sw);
        viewResult.ViewEngine.ReleaseView(ControllerContext, viewResult.View);
        return sw.GetStringBuilder().ToString();
    }
}

What I've tried:

Return on action method set to JsonResult

No content type specified in response, ajax call contentType: application/json; charset=utf-8

IE 8 pointing to staging server IIS prompts to download the file
IE 9 pointing to staging server IIS does nothing at all
Chrome pointing to staging server IIS does nothing at all
Chrome pointing to local webserver does nothing at all

application/json; charset=utf-8 specified in response, no content type on ajax call

IE 8 pointing to staging server IIS prompts to download the file
IE 9 pointing to staging server IIS works perfect
Chrome pointing to staging server IIS works perfect
Chrome pointing to local webserver works perfect

At this point I have 3 out of 4 ways working great, IE 8 sucks. So now I change the action method result.

Return on action method set to ActionResult

No content type specified in response, ajax call contentType: application/json; charset=utf-8

IE 8 pointing to staging server IIS prompts to download the file
IE 9 pointing to staging server IIS does nothing at all
Chrome pointing to staging server IIS does nothing at all
Chrome pointing to local webserver does nothing at all

At this time I believe having a contentType specified in the ajax call itself is BAD.

application/json; charset=utf-8 specified in response, no content type on ajax call

IE 8 pointing to staging server IIS prompts to download the file
IE 9 pointing to staging server IIS works perfect
Chrome pointing to staging server IIS works perfect
Chrome pointing to local webserver works perfect

I've even added the script file JSON2.js to the project and referenced the script in the view, this didn't do anything at all.

Here' the crazy part, I have another controller set up the same way, it builds teh json exactly the same, the only difference is the view that calls the ajax calls it slightly differently. Here's that Ajax method:

function setApprovalStatus(username, isApproved) {
    $.ajax({
        url: "/ELMAdmin/SetApprovalStatus/",
        dataType: "json",
        cache: false,
        type: 'POST',
        data: { username: username, isApproved: isApproved },
        success: function (result) {
            showManageUsersSuccessError(result);
        }
    });
}

It calls the same sub routine to render the grid, the only difference is the data that is returned. So I stripped all the text out of the partial view and IE still attempts to download the file. I feel like I've tried everything I know and now need some extra eyes to help point out what I am hoping is something obvious.

Buildstarted · Accepted Answer

Ok, after looking at the sample and testing it out you need to add this content type to your ajax calls.

$.ajax({
    url: "/ELMAdmin/Search",
    cache: false,
    type: 'POST',
    contentType: "application/x-www-form-urlencoded;charset=utf-8",
    data: { LastName: lastName.value, Username: username.value, EmailAddress: emailAddress.value, SearchFilterType: searchFilterType.value },
    success: function (result) {
        showManageUsersSuccessError(result);
    }
});

notice the contentType is application/x-www-form-urlencoded;charset=utf-8. This should fix any issues with IE8.

In addition, though it could be just the sample, but you'll want to return false in the onclick methods on your search buttons otherwise it will return true and then do a second post.

//Search By User Info
searchByUserBtn.onclick = function (event) {

    entityName.className = "FieldOk";
    entityName.value = "";
    entityName.setAttribute("disabled", "disabled");
    entityTypeID.value = 0;
    entityTypeID.className = "FieldOk";
    entityErrorMsgField.innerHTML = "";
    filterByUserValidation();

    return false;
}

JSON security warning in IE, tries to download in MVC3 app

Answers (2)

Related Questions