Binary files fail to download over SSL using Internet Explorer (IE)

[anonymous]

When trying to download a binary file from my svn repo through trac I get the following error in Internet Explorer 8:

Unable to download <filename> from <host>.

Unable to open this Internet site. The requested site is either unavailable or cannot be found.
Please try again later.

The file downloads fine in Firefox and worked fine when I was using trac 0.11.

I am using Apache 2.2.3 over SSL with trac 0.12.

The response headers being sent by the server are:

Cache-Control: no-cache
Date: Tue, 24 Aug 2010 15:20:16 GMT
Expires: Fri, 01 Jan 1999 00:00:00 GMT
Pragma: no-cache
Content-Length: 3017999
Content-Type: application/zip; charset=iso-8859-15
Last-Modified: Tue, 17 Aug 2010 16:18:16 GMT
Content-Disposition: attachment
Server: Apache/2.2.3 (CentOS)
Connection: close

[anonymous]

I believe this has to do with this Microsoft issue:

​http://support.microsoft.com/kb/316431

Microsoft reports the following:

---

The problem occurs if the server is using Secure Sockets Layer (SSL) and has added one or both of the following HTTP headers to the response message:

Pragma: no-cache
Cache-control: no-cache,max-age=0,must-revalidate

In order for Internet Explorer to open documents in Office (or any out-of-process, ActiveX document server), Internet Explorer must save the file to the local cache directory and ask the associated application to load the file by using IPersistFile::Load. If the file is not stored to disk, this operation fails.

When Internet Explorer communicates with a secure Web site through SSL, Internet Explorer enforces any no-cache request. If the header or headers are present, Internet Explorer does not cache the file. Consequently, Office cannot open the file.

[Benjamin Grabkowitz <bgrabkowitz@…>]

After looking at some code… I have figured out that this only happens when you do not specify a version.

[Benjamin Grabkowitz <bgrabkowitz@…>]

This bug was caused at this revision: r9588

[Remy Blank]

Replying to Benjamin Grabkowitz <bgrabkowitz@…>:

This bug was caused at this revision: r9588

Well, yes, but preventing caching in that case is intentional: as the returned content for the same URL can change at any time, caching must not be done.

I would argue that this is a bug in IE. More specifically, caching and starting an external application with a downloaded file are different operations, and don't need to be coupled. IE should be smart enough not to cache if requested, but still write the file to disk before launching an external application with it.

(Also, "enforce no-cache requests" only for SSL connections sounds weird. Why shouldn't it obey no-cache requests on non-SSL connections as well?)

Tending to a wontfix, unless we can control this "writing out to file" behavior of IE with a specific header that will keep caching disabled.

[Benjamin Grabkowitz <bgrabkowitz@…>]

A possible solution might to remove

Pragma: no-cache Cache-control: no-cache

And replace with:

Cache-control: no-store

For ssl requests.

[Christian Boos]

PatchWelcome (not only that, but also thorough testing of the patch with all the browsers…).