SSL, IE6, & "Mixed Content"

Question

I have a servlet that returns a PDF over SSL, like this (I'm using JSF):
FacesContext faces = FacesContext.getCurrentInstance();
try {
     HttpServletResponse response =
        (HttpServletResponse) faces.getExternalContext().getResponse();
     response.setContentType("application/pdf");
     response.setHeader(
          "Content-disposition",
          "inline; filename=\"MyFile.pdf\"");
     ServletOutputStream out = response.getOutputStream();
     out.write(login.getRole().getPrintfile(this));
     faces.responseComplete();
} catch (Exception e) {
     System.err.println(
          "ERROR: ReportDetails.print() - "
          + login.getRole().toString());
     e.printStackTrace(System.err);
     faces.addMessage(null, new FacesMessage(e.getMessage()));
}This works great on every browser I've tested...except for Internet Explorer. On IE, the user gets a prompt warning that the page contains both secure and non-secure content. As far as I know, that's simply not the case. If the user says not to display the non-secure content, the PDF comes up fine. If the user says go ahead and display everything, the PDF comes up fine. (In Acrobat Reader)
If I go into IE's Tools|Options|Customize, and change "Display mixed content" from "Prompt" to "Enable" everything works fine, and there is no prompt. Curiously, if I change the setting from "Prompt" to "Disable" everything still works fine.
This is annoying. I don't want my users to have to change the default IE settings. Can anyone point me towards a solution?

Answer 1

Thank you for this thread (and to Google for finding it for me). The KB article solves this exact problem for me. However, I am doing this using IIS and ASP.NET. It is ironic that I came to a Sun/Java development site to solve a Microsoft-specific problem. :-)
Yes, I'm using POST (it's a JSF form).
Thank you for the suggestion. I did find a simple
work-around, though.
I found a Microsoft KB article (321532) here:
http://support.microsoft.com/default.aspx?scid=kb;EN-US
321532
It says that there is a bug in IE that is fixed in the
service packs, but that even after you apply the
updates, you need to make sure your server sends
"Accept-Ranges: bytes" in the HTTP response headers.
I tried this, and IE pulled down the PDF, but Acrobat
Reader claimed it was corrupt (again, and again...) I
think there is a problem between Tomcat and Acrobat
Reader using Accept-Ranges: bytes. (See
http://www.mail-archive.com/[email protected]
rg/msg57776.html)