Cannot Download XLS Document Via HTTPS

I've seen old threads and posts about this, but it's a problem that has
recently cropped up with Win2K3 R2 SP2 and IE6 SP2, IE7.

We have a secure web server that creates Excel documents of selected data
then outputs the document as a page to the user, with this code:

FileStream fs = new FileStream( AbsDir + "\\" + FileName, FileMode.Open );
long fsize = fs.Length;
byte[] Buffer = new Byte[fsize];
fs.Read( Buffer, 0, (int)fsize );
fs.Close();

Response.ClearHeader();
Response.ClearContent();
Response.Clear();
Response.ContentType = "application/octet-stream-dummy";
Response.AddHeader( "Content-Disposition", "inline; filename =" +
FileName );
Response.AddHeader( "Content-Length", FileSize.ToString() );
Response.BinaryWrite(Buffer);
Response.Buffer = true;
Response.Flush();
Response.Clear();
Response.End();

Our existing server (2000 Advanced Server SP4) is working fine, but the new
server (2003 64-bit Standard R2 SP2) doesn't. The above code correctly shows
the Download file dialog or opens the Excel document in a window (depending
on the client settings), so long as the user connects to the website via
HTTP. As soon as they try using HTTPS they get an error. No download dialog
is shown and no file is downloaded.

What I am trying to avoid is having users mess about with their IE settings
just to download Excel documents, especially since the above code works fine
for PDF documents over HTTPS, and yes, the site they are accessing is in
their IE Trusted Zone.

I certainly can't have them make registry changes or check the "Do not save
encrypted pages to disk" checkbox every time they use our site, and then
uncheck it when they visit other sites. I'm talking about over 10,000 users
here from over 100 companies.

In the interest of bettering customer relations (which is why we're
upgrading the servers), I have no problem with making whatever changes I need
to make to the IIS servers to get XLS downloads over HTTPS to work every
time, regardless of browser settings or versions. So far, nothing I've tried
has worked.

If someone would be so kind as to spell out what IIS settings should be
changed, and exactly what C# code I should be using, then I would be very
grateful and you'd earn a lot of kudos.

"Andrew Hayes" <AndrewHayes.DeleteThis@discussions.microsoft.com> wrote in message
news:2AACBE2F-7A47-40DF-89EA-674738A83547@microsoft.com...
> I've seen old threads and posts about this, but it's a problem that has
> recently cropped up with Win2K3 R2 SP2 and IE6 SP2, IE7.
>
> We have a secure web server that creates Excel documents of selected data
> then outputs the document as a page to the user, with this code:
>
> FileStream fs = new FileStream( AbsDir + "\\" + FileName,
FileMode.Open );
> long fsize = fs.Length;
> byte[] Buffer = new Byte[fsize];
> fs.Read( Buffer, 0, (int)fsize );
> fs.Close();
>
> Response.ClearHeader();
> Response.ClearContent();
> Response.Clear();
> Response.ContentType = "application/octet-stream-dummy";
> Response.AddHeader( "Content-Disposition", "inline; filename =" +
> FileName );
> Response.AddHeader( "Content-Length", FileSize.ToString() );
> Response.BinaryWrite(Buffer);
> Response.Buffer = true;
> Response.Flush();
> Response.Clear();
> Response.End();
>
> Our existing server (2000 Advanced Server SP4) is working fine, but the
new
> server (2003 64-bit Standard R2 SP2) doesn't. The above code correctly
shows
> the Download file dialog or opens the Excel document in a window
(depending
> on the client settings), so long as the user connects to the website via
> HTTP. As soon as they try using HTTPS they get an error. No download
dialog
> is shown and no file is downloaded.
>
> What I am trying to avoid is having users mess about with their IE
settings
> just to download Excel documents, especially since the above code works
fine
> for PDF documents over HTTPS, and yes, the site they are accessing is in
> their IE Trusted Zone.
>
> I certainly can't have them make registry changes or check the "Do not
save
> encrypted pages to disk" checkbox every time they use our site, and then
> uncheck it when they visit other sites. I'm talking about over 10,000
users
> here from over 100 companies.
>
> In the interest of bettering customer relations (which is why we're
> upgrading the servers), I have no problem with making whatever changes I
need
> to make to the IIS servers to get XLS downloads over HTTPS to work every
> time, regardless of browser settings or versions. So far, nothing I've
tried
> has worked.
>
> If someone would be so kind as to spell out what IIS settings should be
> changed, and exactly what C# code I should be using, then I would be very
> grateful and you'd earn a lot of kudos.

Your code can be replaced with this:-

Response.Clear();
Response.ContentType = "application/octet-stream";
Response.AddHeader( "Content-Disposition",
"attachment; filename =" + FileName );

Response.WriteFile(AbsDir + "\\" + FileName);

However if these files are large you should read this:-

http://support.microsoft.com/kb/812406

(Note in the more info repro code Response.Flush() is used, IMO, this is not
desirable because it will force Transfer encoding to be used which may mean
the browser won't be able to display a meaningful progress bar.)

--
Anthony Jones - MVP ASP/ASP.NET