Cannot Download XLS Document Via HTTPS

I've seen old threads and posts about this, but it's a problem that has
recently cropped up with Win2K3 R2 SP2 and IE6 SP2, IE7.

We have a secure web server that creates Excel documents of selected data
then outputs the document as a page to the user, with this code:

FileStream fs = new FileStream( AbsDir + "\\" + FileName, FileMode.Open );
long fsize = fs.Length;
byte[] Buffer = new Byte[fsize];
fs.Read( Buffer, 0, (int)fsize );
fs.Close();

Response.ClearHeader();
Response.ClearContent();
Response.Clear();
Response.ContentType = "application/octet-stream-dummy";
Response.AddHeader( "Content-Disposition", "inline; filename =" +
FileName );
Response.AddHeader( "Content-Length", FileSize.ToString() );
Response.BinaryWrite(Buffer);
Response.Buffer = true;
Response.Flush();
Response.Clear();
Response.End();

Our existing server (2000 Advanced Server SP4) is working fine, but the new
server (2003 64-bit Standard R2 SP2) doesn't. The above code correctly shows
the Download file dialog or opens the Excel document in a window (depending
on the client settings), so long as the user connects to the website via
HTTP. As soon as they try using HTTPS they get an error. No download dialog
is shown and no file is downloaded.

What I am trying to avoid is having users mess about with their IE settings
just to download Excel documents, especially since the above code works fine
for PDF documents over HTTPS, and yes, the site they are accessing is in
their IE Trusted Zone.

I certainly can't have them make registry changes or check the "Do not save
encrypted pages to disk" checkbox every time they use our site, and then
uncheck it when they visit other sites. I'm talking about over 10,000 users
here from over 100 companies.

In the interest of bettering customer relations (which is why we're
upgrading the servers), I have no problem with making whatever changes I need
to make to the IIS servers to get XLS downloads over HTTPS to work every
time, regardless of browser settings or versions. So far, nothing I've tried
has worked.

If someone would be so kind as to spell out what IIS settings should be
changed, and exactly what C# code I should be using, then I would be very
grateful and you'd earn a lot of kudos.

Re: Cannot Download XLS Document Via HTTPS

"Andrew Hayes" wrote in message
news:2AACBE2F-7A47-40DF-89EA-674738A83547@microsoft.com...
> I've seen old threads and posts about this, but it's a problem that has
> recently cropped up with Win2K3 R2 SP2 and IE6 SP2, IE7.
>
> We have a secure web server that creates Excel documents of selected data
> then outputs the document as a page to the user, with this code:
>
> FileStream fs = new FileStream( AbsDir + "\\" + FileName,
FileMode.Open );
> long fsize = fs.Length;
> byte[] Buffer = new Byte[fsize];
> fs.Read( Buffer, 0, (int)fsize );
> fs.Close();
>
> Response.ClearHeader();
> Response.ClearContent();
> Response.Clear();
> Response.ContentType = "application/octet-stream-dummy";
> Response.AddHeader( "Content-Disposition", "inline; filename =" +
> FileName );
> Response.AddHeader( "Content-Length", FileSize.ToString() );
> Response.BinaryWrite(Buffer);
> Response.Buffer = true;
> Response.Flush();
> Response.Clear();
> Response.End();
>
> Our existing server (2000 Advanced Server SP4) is working fine, but the
new
> server (2003 64-bit Standard R2 SP2) doesn't. The above code correctly
shows
> the Download file dialog or opens the Excel document in a window
(depending
> on the client settings), so long as the user connects to the website via
> HTTP. As soon as they try using HTTPS they get an error. No download
dialog
> is shown and no file is downloaded.
>
> What I am trying to avoid is having users mess about with their IE
settings
> just to download Excel documents, especially since the above code works
fine
> for PDF documents over HTTPS, and yes, the site they are accessing is in
> their IE Trusted Zone.
>
> I certainly can't have them make registry changes or check the "Do not
save
> encrypted pages to disk" checkbox every time they use our site, and then
> uncheck it when they visit other sites. I'm talking about over 10,000
users
> here from over 100 companies.
>
> In the interest of bettering customer relations (which is why we're
> upgrading the servers), I have no problem with making whatever changes I
need
> to make to the IIS servers to get XLS downloads over HTTPS to work every
> time, regardless of browser settings or versions. So far, nothing I've
tried
> has worked.
>
> If someone would be so kind as to spell out what IIS settings should be
> changed, and exactly what C# code I should be using, then I would be very
> grateful and you'd earn a lot of kudos.

Your code can be replaced with this:-

Response.Clear();
Response.ContentType = "application/octet-stream";
Response.AddHeader( "Content-Disposition",
"attachment; filename =" + FileName );

Response.WriteFile(AbsDir + "\\" + FileName);

However if these files are large you should read this:-

http://support.microsoft.com/kb/812406

(Note in the more info repro code Response.Flush() is used, IMO, this is not
desirable because it will force Transfer encoding to be used which may mean
the browser won't be able to display a meaningful progress bar.)

--
Anthony Jones - MVP ASP/ASP.NET

Re: Cannot Download XLS Document Via HTTPS

Thanks for the tip Anthony. I tried that and still no joy.

In fact, I'm not sure how I would fix it. As a test, I created a Virtual
Directory on the server (set for read only, browsing enabled) and copied an
XLS and PDF document to there.

By going to the URL, https://myserver/downloads, I can see the 2 files and
can download either by clicking on them. However, if I look at the properties
of the link for the XLS document, copy the entire URL and paste that directly
into the address bar, I get the error.

Is this a security feature of IIS 6 in Windows 2003 R2, or IE 6/7, that
doesn't allow downloads of files directly from the address bar?

As a second test, I tried exactly the same setup on my XP SP2 desktop.
Installed a server certificate on it so I can use HTTPS, created the virtual
directory, enabled browsing, copied a bunch of different files to the folder,
then browsed the files through IE7.0.5730.

I could download all of them by clicking on the link, but only the PDF could
be saved by pasting the URL directly. The DivX, WMA, WMV, and AVI files did
nothing at all, while the DOC, PPT, ISO and XLS files popped up the save
dialog but generated the error -

"Internet Explorer was not able to open this Internet site. The requested
site is either unavailable or cannot be found. Please try again later."

Oh. And just to throw some additional light on it - IE6.0.2900 *will*
download the files via the direct URL
(https://mypc/downloads/sometestexceldoc.xls), but IE6.0.3790 *will not*,
generating the error mentioned above. However, if I clear the Temporary
Internet Files, then I *can* download the files correctly.

I've also tested this with Opera 9.25 and FireFox 2.0.11. Both of those
applications will correctly download the files from the direct URL.

Feel free to try this test yourselves and let me know if you get the same
issue. If not, I would really like to know how your IIS is setup to allow
this. I do not want to be telling all 10,000+ users to clear their temporary
internet folder everytime they want to download *certain* files from our
servers.

Re: Cannot Download XLS Document Via HTTPS

"Andrew Hayes" wrote in message
news:FB9C528E-1338-4F2B-A051-A5D0A2F6C2CB@microsoft.com...
> Thanks for the tip Anthony. I tried that and still no joy.
>
> In fact, I'm not sure how I would fix it. As a test, I created a Virtual
> Directory on the server (set for read only, browsing enabled) and copied
an
> XLS and PDF document to there.
>
> By going to the URL, https://myserver/downloads, I can see the 2 files and
> can download either by clicking on them. However, if I look at the
properties
> of the link for the XLS document, copy the entire URL and paste that
directly
> into the address bar, I get the error.
>
> Is this a security feature of IIS 6 in Windows 2003 R2, or IE 6/7, that
> doesn't allow downloads of files directly from the address bar?
>
> As a second test, I tried exactly the same setup on my XP SP2 desktop.
> Installed a server certificate on it so I can use HTTPS, created the
virtual
> directory, enabled browsing, copied a bunch of different files to the
folder,
> then browsed the files through IE7.0.5730.
>
> I could download all of them by clicking on the link, but only the PDF
could
> be saved by pasting the URL directly. The DivX, WMA, WMV, and AVI files
did
> nothing at all, while the DOC, PPT, ISO and XLS files popped up the save
> dialog but generated the error -
>
> "Internet Explorer was not able to open this Internet site. The requested
> site is either unavailable or cannot be found. Please try again later."
>
> Oh. And just to throw some additional light on it - IE6.0.2900 *will*
> download the files via the direct URL
> (https://mypc/downloads/sometestexceldoc.xls), but IE6.0.3790 *will not*,
> generating the error mentioned above. However, if I clear the Temporary
> Internet Files, then I *can* download the files correctly.
>
> I've also tested this with Opera 9.25 and FireFox 2.0.11. Both of those
> applications will correctly download the files from the direct URL.
>
> Feel free to try this test yourselves and let me know if you get the same
> issue. If not, I would really like to know how your IIS is setup to allow
> this. I do not want to be telling all 10,000+ users to clear their
temporary
> internet folder everytime they want to download *certain* files from our
> servers.
>

There is too much detail here. Can't see the wood for the trees,

Lets forget other browsers and stick with IE7 running on XP SP2. The server
is Windows 2003. Lets also forget directory browsing (I never enable that
and its distracting). We know we have virtual folder called downloads
containing an excel document called sometestexceldoc.xls.

https://myServer/downloads/sometestexceldoc.xls

the above is placed in the address bar. What happens?

BTW, Get this:- www.fiddlertool.com

Install it and have it running when doing the test. It will show you
exactly what the converstation between the browser and the web server
contains. You can use it to compare successful downloads with failed ones.

Also check the server mimemap and ensure that .xsl is mapped to the
appropriate mimetype.

--
Anthony Jones - MVP ASP/ASP.NET

Re: Cannot Download XLS Document Via HTTPS

Sorry about that Anthony. Habitual for me to try any and everything to find a
workaround that works consistently.

Anyhow. Back to basics. Installed the Fiddlertool 2.0, enabled the HTTPS
decryption, and captured the session info.

This is what I had for the header information when I *attempt* to download
the XLS document from the server via the URL:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 246272
Content-Type: application/vnd.ms-excel
Last-Modified: Mon, 07 Jan 2008 02:28:13 GMT
Accept-Ranges: bytes
ETag: "69d726f4d450c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:43:41 GMT

The header information for the PDF document that downloads successfully from
the URL is:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 22827
Content-Type: application/pdf
Last-Modified: Mon, 07 Jan 2008 02:16:04 GMT
Accept-Ranges: bytes
ETag: "4fa92341d350c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:44:34 GMT

I've also tried setting the Cache-Control header on the server side to
public and max-age=86400, and even removing it completely, none of which had
any affect. This would seem to indicate that KB316431 (the part about having
no-cache set) is not applicable in this case.

I also changed the MIME-type so that XLS was "application/octet-stream" and
then "text/plain", but the same problem occurs for both, just the header
shows the different content-type.

Anything else I should try?

Re: Cannot Download XLS Document Via HTTPS

Sorry about that Anthony. Habitual for me to try any and everything to find a
workaround that works consistently.

Anyhow. Back to basics. Installed the Fiddlertool 2.0, enabled the HTTPS
decryption, and captured the session info.

This is what I had for the header information when I *attempt* to download
the XLS document from the server via the URL:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 246272
Content-Type: application/vnd.ms-excel
Last-Modified: Mon, 07 Jan 2008 02:28:13 GMT
Accept-Ranges: bytes
ETag: "69d726f4d450c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:43:41 GMT

The header information for the PDF document that downloads successfully from
the URL is:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 22827
Content-Type: application/pdf
Last-Modified: Mon, 07 Jan 2008 02:16:04 GMT
Accept-Ranges: bytes
ETag: "4fa92341d350c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:44:34 GMT

I've also tried setting the Cache-Control header on the server side to
public and max-age=86400, and even removing it completely, none of which had
any affect. This would seem to indicate that KB316431 (the part about having
no-cache set) is not applicable in this case.

I also changed the MIME-type so that XLS was "application/octet-stream" and
then "text/plain", but the same problem occurs for both, just the header
shows the different content-type.

Anything else I should try?

Re: Cannot Download XLS Document Via HTTPS

Sorry about that Anthony. Habitual for me to try any and everything to find a
workaround that works consistently.

Anyhow. Back to basics. Installed the Fiddlertool 2.0, enabled the HTTPS
decryption, and captured the session info.

This is what I had for the header information when I *attempt* to download
the XLS document from the server via the URL:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 246272
Content-Type: application/vnd.ms-excel
Last-Modified: Mon, 07 Jan 2008 02:28:13 GMT
Accept-Ranges: bytes
ETag: "69d726f4d450c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:43:41 GMT

The header information for the PDF document that downloads successfully from
the URL is:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 22827
Content-Type: application/pdf
Last-Modified: Mon, 07 Jan 2008 02:16:04 GMT
Accept-Ranges: bytes
ETag: "4fa92341d350c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:44:34 GMT

I've also tried setting the Cache-Control header on the server side to
public and max-age=86400, and even removing it completely, none of which had
any affect. This would seem to indicate that KB316431 (the part about having
no-cache set) is not applicable in this case.

I also changed the MIME-type so that XLS was "application/octet-stream" and
then "text/plain", but the same problem occurs for both, just the header
shows the different content-type.

Anything else I should try?

Re: Cannot Download XLS Document Via HTTPS

Sorry about that Anthony. Habitual for me to try any and everything to find a
workaround that works consistently.

Anyhow. Back to basics. Installed the Fiddlertool 2.0, enabled the HTTPS
decryption, and captured the session info.

This is what I had for the header information when I *attempt* to download
the XLS document from the server via the URL:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 246272
Content-Type: application/vnd.ms-excel
Last-Modified: Mon, 07 Jan 2008 02:28:13 GMT
Accept-Ranges: bytes
ETag: "69d726f4d450c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:43:41 GMT

The header information for the PDF document that downloads successfully from
the URL is:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 22827
Content-Type: application/pdf
Last-Modified: Mon, 07 Jan 2008 02:16:04 GMT
Accept-Ranges: bytes
ETag: "4fa92341d350c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:44:34 GMT

I've also tried setting the Cache-Control header on the server side to
public and max-age=86400, and even removing it completely, none of which had
any affect. This would seem to indicate that KB316431 (the part about having
no-cache set) is not applicable in this case.

I also changed the MIME-type so that XLS was "application/octet-stream" and
then "text/plain", but the same problem occurs for both, just the header
shows the different content-type.

Anything else I should try?

Re: Cannot Download XLS Document Via HTTPS

Sorry about that Anthony. Habitual for me to try any and everything to find a
workaround that works consistently.

Anyhow. Back to basics. Installed the Fiddlertool 2.0, enabled the HTTPS
decryption, and captured the session info.

This is what I had for the header information when I *attempt* to download
the XLS document from the server:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 246272
Content-Type: application/vnd.ms-excel
Last-Modified: Mon, 07 Jan 2008 02:28:13 GMT
Accept-Ranges: bytes
ETag: "69d726f4d450c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:43:41 GMT

The header information for the PDF document that downloads successfully is
almost identical:

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 22827
Content-Type: application/pdf
Last-Modified: Mon, 07 Jan 2008 02:16:04 GMT
Accept-Ranges: bytes
ETag: "4fa92341d350c81:4fa"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Mon, 07 Jan 2008 02:44:34 GMT

I tried changing Cache-Control to public, to expire after 1 day, and
removing it completely. I also tried changing the MIME-type for XLS to be
application/octet-stream and text/plain. None of these made any difference.

For fun, I changed the MIME-type to application/pdf. In this case, the file
downloaded but Acrobat complained that it doesn't start with %PDF-.

Re: Cannot Download XLS Document Via HTTPS

Can you use Fiddler tool to download the XLS over HTTPS from the
existing IIS5/W2K server which works and report the response headers
-- and see if they differ from the response headers of the XLS over
HTTPS returned from IIS6/WS03 which you say does not work.

Ultimately, this is a client-side issue because you'd see that IIS
faithfully sends the XLS data to the client in all cases, and you say
that the download works with Opera and Firefox.

To be clear, it's the client's arbitrary decision that you are trying
to influence with server's response, and if you make IIS6 send back
the same thing as IIS5, then it should work identically.

In other words, this issue really has nothing to do with WS03 -- the
server is not preventing download of XLS over HTTPS (because you'd see
the content being sent) -- it is the client that is rejecting the file
after the download.

If the above still doesn't work, then the problem is clearly outside
of IIS and we'd need to start looking elsewhere...


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//



On Dec 27 2007, 4:36=A0pm, Andrew Hayes
wrote:
> I've seen old threads and posts about this, but it's a problem that has
> recently cropped up with Win2K3 R2 SP2 and IE6 SP2, IE7.
>
> We have a secure web server that creates Excel documents of selected data
> then outputs the document as a page to the user, with this code:
>
> =A0 =A0 FileStream fs =3D new FileStream( AbsDir + "\\" + FileName, FileMo=
de.Open );
> =A0 =A0 long fsize =3D fs.Length;
> =A0 =A0 byte[] Buffer =3D new Byte[fsize];
> =A0 =A0 fs.Read( Buffer, 0, (int)fsize );
> =A0 =A0 fs.Close();
>
> =A0 =A0 Response.ClearHeader();
> =A0 =A0 Response.ClearContent();
> =A0 =A0 Response.Clear();
> =A0 =A0 Response.ContentType =3D "application/octet-stream-dummy";
> =A0 =A0 Response.AddHeader( "Content-Disposition", "inline; filename =3D" =
+
> FileName );
> =A0 =A0 Response.AddHeader( "Content-Length", FileSize.ToString() ); =A0
> =A0 =A0 Response.BinaryWrite(Buffer);
> =A0 =A0 Response.Buffer =3D true;
> =A0 =A0 Response.Flush();
> =A0 =A0 Response.Clear();
> =A0 =A0 Response.End();
>
> Our existing server (2000 Advanced Server SP4) is working fine, but the ne=
w
> server (2003 64-bit Standard R2 SP2) doesn't. The above code correctly sho=
ws
> the Download file dialog or opens the Excel document in a window (dependin=
g
> on the client settings), so long as the user connects to the website via
> HTTP. As soon as they try using HTTPS they get an error. No download dialo=
g
> is shown and no file is downloaded.
>
> What I am trying to avoid is having users mess about with their IE setting=
s
> just to download Excel documents, especially since the above code works fi=
ne
> for PDF documents over HTTPS, and yes, the site they are accessing is in
> their IE Trusted Zone.
>
> I certainly can't have them make registry changes or check the "Do not sav=
e
> encrypted pages to disk" checkbox every time they use our site, and then
> uncheck it when they visit other sites. I'm talking about over 10,000 user=
s
> here from over 100 companies.
>
> In the interest of bettering customer relations (which is why we're
> upgrading the servers), I have no problem with making whatever changes I n=
eed
> to make to the IIS servers to get XLS downloads over HTTPS to work every
> time, regardless of browser settings or versions. So far, nothing I've tri=
ed
> has worked.
>
> If someone would be so kind as to spell out what IIS settings should be
> changed, and exactly what C# code I should be using, then I would be very
> grateful and you'd earn a lot of kudos.

Re: Cannot Download XLS Document Via HTTPS

Hi David.

Can't do that I'm afraid, since our production server was changed to W2K3
(we no longer have a W2K server - which is why it's causing such a problem).
But yes, I understand it is viewed as a client issue, since it works fine
with IE6.0.2900 / FireFox / Opera but not IE7.0.5730.

All I'm trying to do is figure a way to get it to work with the latest IE
without requiring our users to jump through hoops. Since it downloads files
perfectly well over HTTP, why wouldn't it download them over HTTPS?

All of the KB articles concerning downloading XLS over HTTPS seem to imply
it's something to do with the cache, but as you can see, I've tried many
combinations of cache-control header values with no success.

Re: Cannot Download XLS Document Via HTTPS

"Andrew Hayes" wrote in message
news:8B25295E-8159-4BF3-96FF-EDD8A1D61CBF@microsoft.com...
> Sorry about that Anthony. Habitual for me to try any and everything to
find a
> workaround that works consistently.
>
> Anyhow. Back to basics. Installed the Fiddlertool 2.0, enabled the HTTPS
> decryption, and captured the session info.
>
> This is what I had for the header information when I *attempt* to download
> the XLS document from the server via the URL:
>
> HTTP/1.1 200 OK
> Cache-Control: private
> Content-Length: 246272
> Content-Type: application/vnd.ms-excel
> Last-Modified: Mon, 07 Jan 2008 02:28:13 GMT
> Accept-Ranges: bytes
> ETag: "69d726f4d450c81:4fa"
> Server: Microsoft-IIS/6.0
> X-Powered-By: ASP.NET
> Date: Mon, 07 Jan 2008 02:43:41 GMT
>
> The header information for the PDF document that downloads successfully
from
> the URL is:
>
> HTTP/1.1 200 OK
> Cache-Control: private
> Content-Length: 22827
> Content-Type: application/pdf
> Last-Modified: Mon, 07 Jan 2008 02:16:04 GMT
> Accept-Ranges: bytes
> ETag: "4fa92341d350c81:4fa"
> Server: Microsoft-IIS/6.0
> X-Powered-By: ASP.NET
> Date: Mon, 07 Jan 2008 02:44:34 GMT
>
> I've also tried setting the Cache-Control header on the server side to
> public and max-age=86400, and even removing it completely, none of which
had
> any affect. This would seem to indicate that KB316431 (the part about
having
> no-cache set) is not applicable in this case.
>
> I also changed the MIME-type so that XLS was "application/octet-stream"
and
> then "text/plain", but the same problem occurs for both, just the header
> shows the different content-type.
>
> Anything else I should try?

In the advanced tab of IE7 internet options find the security section.
What is the state of the 'Do not save encrypted pages to disk' option?

--
Anthony Jones - MVP ASP/ASP.NET

Re: Cannot Download XLS Document Via HTTPS

> In the advanced tab of IE7 internet options find the security section.
> What is the state of the 'Do not save encrypted pages to disk' option?

Unchecked, which would imply that it saves encrypted pages to disk.