Cannot download a file with internet explorer 6 using SSL connection

Question

Hello,
I am working on a application that uses SSL. But when the clicks a button to donwload a file using IE 6 or IE 7, internet explorer shows a error message saying that "The internet explorer cannot open this site". This error dont occur in Firefox, but i have to use Internet Explorer. And the error occurs only if i use https, with http it works fine.
I search the net and i found that internet explorer has a bug, that when the server sends the http header "Pragma: no-cache" or "Cache-control: no-cache,max-age=0,must-revalidate", then the internet explorer doesnt cache the file, and i cannot open it. See here: http://support.microsoft.com/kb/316431/en-us
My problem is that OC4J appears to send this headers automatically. I am using Oracle Enterprise Manager 10g Application Server Control 10.1.3.3.0. Here, is my code to send the file:
HttpServletResponse response = (HttpServletResponse)
FacesContext.getCurrentInstance().getExternalContext().getResponse();
response.setContentType("application/x-download");
response.setHeader("Content-Disposition", "attachement; filename=\"file.pfx\"");
response.setContentLength((new Long(myFile.length())).intValue());
OutputStream out=null;
try {
out = response.getOutputStream();
fis = new FileInputStream(myFile);
int n;
while ((n = fis.available())> 0) {
b = new byte[n];
int result = fis.read(b);
out.write(b, 0, b.length);
if (result == -1) break;
out.flush();
out.close();
} catch (Exception e){
throw new DownloadException("Erro ao enviar arquivo para o stream de download.");
finally{
FacesContext.getCurrentInstance().responseComplete();
You can see that i not send that headers in this code.
Here, is the headers sent to IE when i use https.
HTTP/1.x 200 OK
Date: Wed, 07 May 2008 17:40:28 GMT
Server: Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server
Pragma: no-cache
Cache-Control: no-store
Surrogate-Control: no-store
Expires: Thu, 01 Jan 1970 12:00:00 GMT
Content-Length: 5208
Set-Cookie: JSESSIONID=ac1002292008f788e14d0d6e40c29f3185f2fc72e5b9.e3eTb3mTb3yKe34SbhqOaxyTe6fznA5Pp7ftnR9Jrl0; path=/actcers; secure
content-disposition: attachement; filename="file.pfx"
Keep-Alive: timeout=15, max=74
Connection: Keep-Alive
Content-Type: application/x-download
I hope that someone can helpme.
Tanks
Message was edited by:
user635088

Answer 1

Hi!
I don't have a solution fou you, just a few ideas =)
You can check what headers response contains with
response.containsHeader( "your_header_here");
http://java.sun.com/j2ee/sdk_1.2.1/techdocs/api/javax/servlet/http/HttpServletResponse.html#containsHeader(java.lang.String)
after that you could set/overwrite those headers that you don't like with, for example:
response.setHeader("Cache-control", "no-cache,max-age=0,must-revalidate");
Aparently Pragma and Cache-control headers should be used in pair, as noted here
http://curl.haxx.se/mail/archive-2005-12/0003.html
quote:"The author of Bad Behavior points out that RFC2616 requires that a
Pragma: header to be accompanied by a Cache-Control: header. From what I
see, it only says "SHOULD" (in section 14.32), but that is still a
strong recommendation and something to be considered, IMHO."
I'm a bit sceptical about you needing to cache the file, but if you feel strong about it, you could read this
http://www.mnot.net/cache_docs/#META
If you're working on SSL there is supposed to be some kind of validation, certificate or something like that. IE6 and 7 both have strong security measures in these regards. Maybe you should look something up in that direction.
Hope I helped.