CODEWITHSUNDEEP
internet-explorerssl
ndtreviv
ndtreviv

Reputation: 3624

Windows 7, IE 8, SSL (128bit keys, TLS 1.2): Attempts to download webpage instead of displaying it. Fails horribly

The Problem

This only happens with IE 8.

When viewing the landing page of our web application, there are no problems.

After logging in, instead of displaying the individual pages, IE will attempt to download them.

Note: I am not attempting to download a file! I am viewing a webpage.

Firstly, the yellow file download alert will popup saying that it prevented the site from automatically downloading a file, which is in itself very odd.

When I decide to humour IE 8 and choose to "Download File", I get a file download progress window titled 0% of [page] from [site] and an overlaying dialog saying:

Unable to download [page] from [site].  

Unable to open this internet site. The requested site is either unavailable or cannot be found. 
Please try again later.

If I refresh the page, I get the classic re-post warning dialog, even though nothing is being POST-ed. (It's a GET request to get the page)

What I've Tried

Everywhere I look, answers revolve around one of the following:

  1. Cache (Pragma and Content-Control) headers
  2. Vary header
  3. Compatibility Mode
  4. Security Settings

So, I have tried:

Fiddling the Headers

but the default headers look ok to me, being:

Cache-Control: private
Content-Encoding: gzip
Content-Length: 4875
Content-Type: text/html; charset=utf-8
Date: Wed, 28 Sep 2016 10:34:12 GMT
Server: Google Frontend
Vary: Accept-Encoding
X-Cloud-Trace-Context: 6f408420c3e0f28303f908800082de51

This includes setting a custom Cache-Control and adding a Pragma header, as well as removing the Vary header. All to noavail.

According to IE Internals setting Vary to Accept-Encoding is totally valid if the Content-Encoding is gzip, which it is.

Toggling Compatibility Mode

both for individual and all sites.

Adjusting Security Levels

including:

  1. Adding the site to trusted sites
  2. Setting trusted sites zone to low security, and then setting a custom level to make it even lower
  3. Turning off SSL 2.0
  4. Turning off All SSL and TLS except for TLS 1.2
  5. Resetting IE settings
  6. Clearing SSL Cache
  7. Installing the SSL certificate

The Question[s]

  1. Why is this happening?
  2. What can I do to get it to work on IE 8? (Upgrading is not an option)

Upvotes: 0

Views: 131

Answers (1)

ndtreviv
ndtreviv

Reputation: 3624

So it turns out the answer was that we had an Authentication Filter which was filtering requests based on the Accept header.

IE 8 in all of it's glorious wisdom had decided that it was going to request our page with the following Accept value: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/jpeg, application/x-ms-xbap, */*

Our site was responding with a 401, and IE8, because it had requested it as an image, was handling it accordingly.

Why this was only happening via SSL...

IH8 IE8.

Upvotes: 1

Related Questions