ColdFusion 11 cfheader not being passed correctly in IE 8

Question

I have a stumper. Installed CF11 on our test server. Did some regression testing and am running into an issue. I have a .cfm that downloads information to excel. It renders fine in CF10 (and prior versions). In CF11, it renders fine in IE10 and in FireFox. It however fails horribly in IE8 and since most of our users are still required to be on IE8, this is a showstopper.

Here is the code that sets up the excel dump - page name is show_table.cfm:

    <cfif IsDefined('URL.ExcelDump')> 
        <cfheader name="Content-Disposition" value="filename=#Session.utilstablename#.xls">
        <cfcontent type="application/vnd.ms-excel">
    </cfif>

I have already turned off these lines - with no change in the below error:

   <META http-EQUIV="Pragma" CONTENT="no-cache">  
   <META http-EQUIV="cache-control" CONTENT=" no-store,no-cache, must-revalidate"> 

This is what I expect to happen - IE10 does a similar open/save panel:

here is what happens in IE8:

Note that the filename on the fail is the same as the .cfm page that is trying to do the download. Its like it does not see the cfheader setting it to the expected name (which for this particular download should be er_quality_items_view.xls).

Any words of wisdom? is there a setting in IIS (we use 8) that might affect this behavior?

Answer 1

Specific to your problem is the behavior of some versions of IE, per MVP Erik Law (link below):

"if a user tries to download a file over a HTTPS connection, any response headers that prevent caching will cause the file download process to fail."

So, it's actually the provision of Cache-Control header tokens like no-cache & no-store, a Vary header or the infamous Pragma no-cache header which are causing the browser to abort the download when over ssl. Assuming Erik Law's blog link survives the test of time, you can read all about it via the link below.

So, site-wide CFHEADER cache settings may be good in general, but you'll want to clear all that out when it comes to downloading files. Try placing this little gem above your download CFML code:
<cfset getPageContext().getResponse().reset() />
and test again.

http://blogs.msdn.com/b/ieinternals/archive/2009/10/03/internet-explorer-cannot-download-over-https-when-no-cache.aspx
https://groups.google.com/forum/?fromgroups#!topic/openbd/ke6cSVHXMfM

Answer 2

I have looked high and low for this answer! I wanted to say thank you because it help me fix a related issue with links and microsoft office (Word, Powerpoint, Excel). If a user clicks on a link from Word and it is an Https website and it is using cfheader to serve pdf files on the page, it will fail with a "Unable to open https://....pdf. Cannot open the specified file." If you go to the page directly or click from Outlook it works fine.

On Edge, I right-clicked on the page and select "Inspect" to see the page code source.

When using cfheader to serve a file, by default it sets it to:

Cache-Control: no-cache
..
Pragma: no-cache

The no-cache is why it is making it fail. To override this setting, do the first 3 lines like this:

<cfset getPageContext().getResponse().reset() /> 
<cfheader name="Cache-Control"  value="max-age=360">
<cfheader name="Pragma" value="cache">

<cfheader name="Content-Disposition" value="inline; filename=#GetResults.report_file_nm1#" >
<cfcontent type="application/pdf" file="#myfilelocation#" deletefile="no">

On Edge, I right-clicked on the page and select "Inspect" to see the page code source again and now see this:

Cache-Control: max-age=360
..
Pragma: cache

More detail on the issue I was trying to solve below:

https://answers.microsoft.com/en-us/msoffice/forum/msoffice_word-mso_win10-mso_o365b/cannot-open-https-hyperlinks-to-pdf-documents-from/7262cd15-9d42-436b-9d0a-074882d25773?page=3

Thanks again! This worked for me.