Cannot download files over SSL in Internet Explorer - where is

--0015174478cae0a7320480f8c68d
Content-Type: text/plain; charset=ISO-8859-1

Hi
I am having trouble downloading files over SSL in Internet Explorer. After
some digging, I believe this is because a Cache-Control: no-cache HTTP
header is being added by my Oracle Apache 2 HTTP proxy server to the
responses sent from my application server. This causes the seemingly
well-known problem described in: http://support.microsoft.com/kb/316431
My question is how to (temporarily at least) disable the adding of the
Cache-Control header. I have tried the following to no avail:
a) Header unset Cache-Control in httpd.conf/ssl.conf
b) Header set Cache-Control - it sends Cache-Control:
no-cache,
c) session.cache_limiter = none in php.ini - no change
d) creating a filter in my application server and setting the Cache-Control
header there; I end up with two Cache-Control headers.
I have kept the default for the modules loaded but wonder if some module is
required to be turned off.
Has anyone got any clues what else I can try? Or what is the answer to this
problem?
thanks, Baljeet.

--0015174478cae0a7320480f8c68d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Re: Cannot download files over SSL in Internet Explorer

On 4 March 2010 12:31, Baljeet Nijjhar wro=
te:
> Hi
> I am having trouble downloading files over SSL in Internet Explorer. Afte=
r
> some digging, I believe this is because a Cache-Control: no-cache HTTP
> header is being added by my Oracle Apache 2 HTTP proxy server to the
> responses sent from my application server. This causes the seemingly
> well-known problem described in: http://support.microsoft.com/kb/316431
> My question is how to (temporarily at least) disable the adding of the
> Cache-Control header. I have tried the following to no avail:
> a) Header unset Cache-Control in httpd.conf/ssl.conf
> b) Header set Cache-Control =A0- it sends Cache-Control:
> no-cache,
> c) session.cache_limiter =3D none in php.ini - no change
> d) creating a filter in my application server and setting the Cache-Contr=
ol
> header there; I end up with two Cache-Control headers.
> I have kept the default for the modules loaded but wonder if some module =
is
> required to be turned off.
> Has anyone got any clues what else I can try? Or what is the answer to th=
is
> problem?

Sounds strange. Do you have anything else modifying the HTTP response
headers in front of your web servers, for example, a load-balancer?

Phil.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Cannot download files over SSL in Internet Explorer

> Sounds strange. Do you have anything else modifying the HTTP response
> headers in front of your web servers, for example, a load-balancer?

Just in case you have an F5 BIG-IP WebAccelerator, there is a known
issue regarding this (needs login):-

https://support.f5.com/kb/en-us/solutions/public/9000/600/so l9671.html

SOL9671: The BIG-IP WebAccelerator may insert an HTTP Cache-Control:
no-cache header into a response when an existing Cache-Control header
is not present

Known Issue
Updated Date: 12/28/2009
This is the result of a known issue. The BIG-IP WebAccelerator inserts
the HTTP Cache-Control: no-cache header into a response. This behavior
occurs when the requested object matches an acceleration policy node
with client cache settings configured with the Do not change option
selected, and the response from the origin web server (OWS) does not
have an existing HTTP Cache-Control header.

Note: The BIG-IP WebAccelerator inserts the HTTP Cache-Control:
no-cache header into a response regardless of whether the Always proxy
request for this node option is selected.

When the HTTP Cache-Control: no-cache header is inserted by the BIG-IP
WebAccelerator, Internet Explorer 6 browser clients may be unable to
display objects with an external application.

Note: For information about this issue, refer to SOL9603: Microsoft
Office documents may not open or save properly when accessed through a
BIG-IP WebAccelerator using Internet Explorer 6.

Note: This behavior was introduced in Hotfix-BIG-IP-9.4.5-HF2 for
BIG-IP WebAccelerator version 9.4.5 to address caching issues with
downstream caches.

[...]

Cheers,
Phil.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Cannot download files over SSL in Internet Explorer

--000e0cdf70e267b6460480fddd3e
Content-Type: text/plain; charset=ISO-8859-1

Hi i dont think there is anything in front. There is some communication with
Oracle WebGate and Oracle Identity and Access Manager but nothing that
obviously sets these headers on the response once it leaves the application
server.
I have tried lots of things:
a) set session.cache_limiter = none in php.ini
b) Header unset Cache-Control in httpd.conf
c) commenting out various modules in httpd.conf
I can add a Header on the proxy server using Header set Cache-Control but
there is still something which adds in a no-cache value after I have set my
value.
thanks, Baljeet.

On Thu, Mar 4, 2010 at 1:53 PM, Philip Wigg wrote:

> > Sounds strange. Do you have anything else modifying the HTTP response
> > headers in front of your web servers, for example, a load-balancer?
>
> Just in case you have an F5 BIG-IP WebAccelerator, there is a known
> issue regarding this (needs login):-
>
> https://support.f5.com/kb/en-us/solutions/public/9000/600/so l9671.html
>
> SOL9671: The BIG-IP WebAccelerator may insert an HTTP Cache-Control:
> no-cache header into a response when an existing Cache-Control header
> is not present
>
> Known Issue
> Updated Date: 12/28/2009
> This is the result of a known issue. The BIG-IP WebAccelerator inserts
> the HTTP Cache-Control: no-cache header into a response. This behavior
> occurs when the requested object matches an acceleration policy node
> with client cache settings configured with the Do not change option
> selected, and the response from the origin web server (OWS) does not
> have an existing HTTP Cache-Control header.
>
> Note: The BIG-IP WebAccelerator inserts the HTTP Cache-Control:
> no-cache header into a response regardless of whether the Always proxy
> request for this node option is selected.
>
> When the HTTP Cache-Control: no-cache header is inserted by the BIG-IP
> WebAccelerator, Internet Explorer 6 browser clients may be unable to
> display objects with an external application.
>
> Note: For information about this issue, refer to SOL9603: Microsoft
> Office documents may not open or save properly when accessed through a
> BIG-IP WebAccelerator using Internet Explorer 6.
>
> Note: This behavior was introduced in Hotfix-BIG-IP-9.4.5-HF2 for
> BIG-IP WebAccelerator version 9.4.5 to address caching issues with
> downstream caches.
>
> [...]
>
> Cheers,
> Phil.
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--000e0cdf70e267b6460480fddd3e
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Re: Cannot download files over SSL in Internet Explorer

On 4 March 2010 18:35, Baljeet Nijjhar wrote:
> Hi i dont think there is anything in front. There is some communication with
> Oracle WebGate and Oracle Identity and Access Manager but nothing that
> obviously sets these headers on the response once it leaves the application
> server.
> I have tried lots of things:
> a) set session.cache_limiter = none in php.ini
> b) Header unset Cache-Control in httpd.conf
> c) commenting out various modules in httpd.conf
> I can add a Header on the proxy server using Header set Cache-Control but
> there is still something which adds in a no-cache value after I have set my
> value.

It might be worth checking that this is definitely the case. Are you
accessing the server over the internet? Is there a test environment
where you can connect directly over a LAN to the Apache server?

Cheers,
Phil.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Cannot download files over SSL in Internet Explorer

--000e0cdf6c6a3193c304810c0228
Content-Type: text/plain; charset=ISO-8859-1

We are connecting directly over a LAN to the Apache proxy server, it is
airgapped network. I also have WebGate, Oracle AccessServer, Oracle Identity
Server Oracle Identity and Access Manager Control and Oracle Internet
Directory 'in the mix'.

On Fri, Mar 5, 2010 at 10:42 AM, Philip Wigg wrote:

> On 4 March 2010 18:35, Baljeet Nijjhar
> wrote:
> > Hi i dont think there is anything in front. There is some communication
> with
> > Oracle WebGate and Oracle Identity and Access Manager but nothing that
> > obviously sets these headers on the response once it leaves the
> application
> > server.
> > I have tried lots of things:
> > a) set session.cache_limiter = none in php.ini
> > b) Header unset Cache-Control in httpd.conf
> > c) commenting out various modules in httpd.conf
> > I can add a Header on the proxy server using Header set Cache-Control but
> > there is still something which adds in a no-cache value after I have set
> my
> > value.
>
> It might be worth checking that this is definitely the case. Are you
> accessing the server over the internet? Is there a test environment
> where you can connect directly over a LAN to the Apache server?
>
> Cheers,
> Phil.
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--000e0cdf6c6a3193c304810c0228
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

We are connecting directly over a LAN to the Apache proxy server, it is air=
gapped network. I also have WebGate, Oracle AccessServer, Oracle Identity S=
erver Oracle Identity and Access Manager Control and Oracle Internet Direct=
ory 'in the mix'.

Re: Cannot download files over SSL in Internet Explorer

On 5 March 2010 11:28, Baljeet Nijjhar wrote:
> We are connecting directly over a LAN to the Apache proxy server, it is
> airgapped network. I also have WebGate, Oracle AccessServer, Oracle Identity
> Server Oracle Identity and Access Manager Control and Oracle Internet
> Directory 'in the mix'.
>
> On Fri, Mar 5, 2010 at 10:42 AM, Philip Wigg wrote:
>>
>> On 4 March 2010 18:35, Baljeet Nijjhar
>> wrote:
>> > Hi i dont think there is anything in front. There is some communication
>> > with
>> > Oracle WebGate and Oracle Identity and Access Manager but nothing that
>> > obviously sets these headers on the response once it leaves the
>> > application
>> > server.

Not strictly Apache but is it possible that Oracle WebGate doing this?

See http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/b3 2420/v2access.htm

--

CachePragmaHeader and CacheControlHeader

These settings apply only to WebGates and control the browser's cache.

By default, CachePragmaHeader and CacheControlHeader are set to
no-cache. This prevents WebGate from caching data at the Web server
application and the user's browser.

However, this may prevent certain operations such as downloading PDF
files or saving report files when the site is protected by a WebGate.

You can set the Access Manager SDK caches that the WebGate uses to
different levels. See
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html section 14.9
for details.

All of the cache-response-directives are allowed. For example, you may
need to set both cache values to public to allow PDF files to be
downloaded.

--

If it's not that, I'm afraid I don't know!

Cheers,
Phil.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Cannot download files over SSL in Internet Explorer

On Fri, Mar 5, 2010 at 6:28 AM, Baljeet Nijjhar
wrote:
> Cache-Control: no-cache HTTP header is being added by my Oracle Apache 2 HTTP
....
> We are connecting directly over a LAN to the Apache proxy server, it is
> airgapped network. I also have WebGate, Oracle AccessServer, Oracle Identity
> Server Oracle Identity and Access Manager Control and Oracle Internet
> Directory 'in the mix'.

Have you asked Oracle?

--
Eric Covener
covener@gmail.com

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Cannot download files over SSL in Internet Explorer

--001636c5ab559a5f4304810e620a
Content-Type: text/plain; charset=ISO-8859-1

It is very possible! I tried changing our WebGate configuration through
Oracle Access Server console by setting CachePragmaHeader and
CacheControlHeader to public as described in the link you sent, and the
headers being sent on my HTTP response were modified, so it appears that
this component is responsible for adding/setting them (and it can't be
undone by updating the Apache proxy server configuration e.g. adding 'Header
unset Cache-Control' in httpd.conf has no effect).
However, IE still doesn't play ball, so I need to work out either a) what
these need to be set for IE/SSL to work or b) work out how to stop WebGate
adding them at all (so we can control them through Apache proxy server or
our application server).
Will update when I have more time, but thanks so much for that. I had come
across this possibiilty before, and had tried modifying a random
WebGateStatic.lst but this had no effect and I gave up. So thanks for making
me look at it again.

On Fri, Mar 5, 2010 at 11:59 AM, Philip Wigg wrote:

> On 5 March 2010 11:28, Baljeet Nijjhar
> wrote:
> > We are connecting directly over a LAN to the Apache proxy server, it is
> > airgapped network. I also have WebGate, Oracle AccessServer, Oracle
> Identity
> > Server Oracle Identity and Access Manager Control and Oracle Internet
> > Directory 'in the mix'.
> >
> > On Fri, Mar 5, 2010 at 10:42 AM, Philip Wigg
> wrote:
> >>
> >> On 4 March 2010 18:35, Baljeet Nijjhar
> >> wrote:
> >> > Hi i dont think there is anything in front. There is some
> communication
> >> > with
> >> > Oracle WebGate and Oracle Identity and Access Manager but nothing that
> >> > obviously sets these headers on the response once it leaves the
> >> > application
> >> > server.
>
> Not strictly Apache but is it possible that Oracle WebGate doing this?
>
> See
> http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/b3 2420/v2access.htm
>
> --
>
> CachePragmaHeader and CacheControlHeader
>
> These settings apply only to WebGates and control the browser's cache.
>
> By default, CachePragmaHeader and CacheControlHeader are set to
> no-cache. This prevents WebGate from caching data at the Web server
> application and the user's browser.
>
> However, this may prevent certain operations such as downloading PDF
> files or saving report files when the site is protected by a WebGate.
>
> You can set the Access Manager SDK caches that the WebGate uses to
> different levels. See
> http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html section 14.9
> for details.
>
> All of the cache-response-directives are allowed. For example, you may
> need to set both cache values to public to allow PDF files to be
> downloaded.
>
> --
>
> If it's not that, I'm afraid I don't know!
>
> Cheers,
> Phil.
>
> ------------------------------------------------------------ ---------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>

--001636c5ab559a5f4304810e620a
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Re: Cannot download files over SSL in Internet Explorer

--001636c5ab553b35bb048110ac72
Content-Type: text/plain; charset=ISO-8859-1

It *seems* that if I set the values of CachePragmaHeader or
CacheControlHeader to blank, the headers are not sent. In addition, if I
then delete my cached files in Internet Explorer it is working. I can open
Word and PDF files, and I don't have to have the Word or PDF application
already open, nor do I have to have BypassSSLNoCacheCheck registry setting
set to true.
Now I have to find out exactly what setting to put the headers to, because
it may not be the wisest option to drop them.
thanks very much for your help!

On Fri, Mar 5, 2010 at 2:18 PM, Baljeet Nijjhar <
baljeet.nijjhar@googlemail.com> wrote:

> It is very possible! I tried changing our WebGate configuration through
> Oracle Access Server console by setting CachePragmaHeader and
> CacheControlHeader to public as described in the link you sent, and the
> headers being sent on my HTTP response were modified, so it appears that
> this component is responsible for adding/setting them (and it can't be
> undone by updating the Apache proxy server configuration e.g. adding 'Header
> unset Cache-Control' in httpd.conf has no effect).
> However, IE still doesn't play ball, so I need to work out either a) what
> these need to be set for IE/SSL to work or b) work out how to stop WebGate
> adding them at all (so we can control them through Apache proxy server or
> our application server).
> Will update when I have more time, but thanks so much for that. I had come
> across this possibiilty before, and had tried modifying a random
> WebGateStatic.lst but this had no effect and I gave up. So thanks for making
> me look at it again.
>
> On Fri, Mar 5, 2010 at 11:59 AM, Philip Wigg wrote:
>
>> On 5 March 2010 11:28, Baljeet Nijjhar
>> wrote:
>> > We are connecting directly over a LAN to the Apache proxy server, it is
>> > airgapped network. I also have WebGate, Oracle AccessServer, Oracle
>> Identity
>> > Server Oracle Identity and Access Manager Control and Oracle Internet
>> > Directory 'in the mix'.
>> >
>> > On Fri, Mar 5, 2010 at 10:42 AM, Philip Wigg
>> wrote:
>> >>
>> >> On 4 March 2010 18:35, Baljeet Nijjhar >> >
>> >> wrote:
>> >> > Hi i dont think there is anything in front. There is some
>> communication
>> >> > with
>> >> > Oracle WebGate and Oracle Identity and Access Manager but nothing
>> that
>> >> > obviously sets these headers on the response once it leaves the
>> >> > application
>> >> > server.
>>
>> Not strictly Apache but is it possible that Oracle WebGate doing this?
>>
>> See
>> http://download.oracle.com/docs/cd/E10761_01/doc/oam.1014/b3 2420/v2access.htm
>>
>> --
>>
>> CachePragmaHeader and CacheControlHeader
>>
>> These settings apply only to WebGates and control the browser's cache.
>>
>> By default, CachePragmaHeader and CacheControlHeader are set to
>> no-cache. This prevents WebGate from caching data at the Web server
>> application and the user's browser.
>>
>> However, this may prevent certain operations such as downloading PDF
>> files or saving report files when the site is protected by a WebGate.
>>
>> You can set the Access Manager SDK caches that the WebGate uses to
>> different levels. See
>> http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html section 14.9
>> for details.
>>
>> All of the cache-response-directives are allowed. For example, you may
>> need to set both cache values to public to allow PDF files to be
>> downloaded.
>>
>> --
>>
>> If it's not that, I'm afraid I don't know!
>>
>> Cheers,
>> Phil.
>>
>> ------------------------------------------------------------ ---------
>> The official User-To-User support forum of the Apache HTTP Server Project.
>> See for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>>
>

--001636c5ab553b35bb048110ac72
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable