You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Tamas Szabo <sz...@gmail.com> on 2005/11/25 21:29:55 UTC
IE "the page contains both secure and nonsecure items?"
Hi All,
I experience a strange problem, maybe somebody had the same issue before.
We have a webapp that generates PDF files on the fly and sends them back to
the browser.
When one accesses the app with https in IE and only in IE they get a message
box
Something like "The page contains both secure and nonsecure items. Do you
want to display both secure and nonsecure items?"
(I'm sure that it isn't the same wording but this is the main idea :-) )
I tried to isolate the problem and it's strange but it seems that I get the
message when I use a POST request instead
of a GET request.
Did someone experience the same problem?
Actually if this is true it should happen not just for PDF's, it would
probably happen to any byte stream that is not html of course...
Thanks,
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by Tamas Szabo <sz...@gmail.com>.
On 11/26/05, Paul Benedict <pa...@yahoo.com> wrote:
>
> That message means you have page in HTTPS but links on that page reffering
> to (at least one) HTTP.
> This is a problem if you have hardcoded the scheme into any of your links.
I understand perfectly what the message means, but there are no links that
refer to HTTP in that page.
Remeber it's a PDF bytestream not a HTML page!
And I'm pretty sure that there are no hardcoded links in the whole
application!
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by "Frank W. Zammetti" <fz...@omnytex.com>.
Welcome to the world of dynamic PDF generation in a webapp :) I think
you could count on one hand the number of people who have done this and
NOT had some sort of problem... and those people just got lucky!
I think we all get to the "it works, I don't know why, but I'm happy"
frame of mind, and then we secretly pray to every deity we can find that
it never breaks :)
Frank
Tamas Szabo wrote:
> Hi All,
>
> First of all Wendy, sorry for convincing you to change your Wiki page.
> You can change it back if you want to...
>
> Actually I'm totaly confused about this bug I haven't replied earlier
> because I
> thought that I will set up an apache with ssl here at home so I can find out
> what really causes it, but at the moment I don't think that I will spend
> time with
> this.. after all it's just a stupid bug, it's not that interesting.
>
> So back to the problem:
>
> We have a writePdfToResponse(...) method. This sets the content-type the
> content-length and writes the pdf to the response.
> This method is called from two Actions one is for GET requests the other is
> for POSTs requests.
> The same method generates the response for both kind of requests so the
> response should be the same in both cases.
> For the POST requests I got the "nonsecure items" message box in IE.
>
> On Monday I tried the following things:
>
> 1. returned a gif file in the same way --> No "nonsecure items" this time so
> it is probably an Acrobat Reader bug.
> 2. Accessing the page without the open PDF in browser setting. No "nonsecure
> items".
> 3. Wrote a servlet that returns the pdf, mapped it to *.pdf, redirected from
> the POST action to the servlet using redirect="true". "nonsecure items"
> message box is still there!!! I thougth that this will work because the GET
> request doesn't show the "nonsecure items" message box.
> 4. Used Wendy's approach, sending a html page that hasa meta refresh header.
> This worked of course.
>
> But.. the clients didn't like the page an the additional redirect.
> So I put back the original code, actually I rewrote it so it is slightly
> different and surprise the "nonsecure items" message box is gone!
> I checked the older code in subversion and at a first glance it seems I am
> doing exactly the same thing. But the message is not there anymore! And I
> suddenly lost all my "appetite" to found out the exact circumstances in
> which this stupid bug occurs.
>
> So thanks for al your help. Wendy please remove the redirect solution from
> your wiki cause it doesn't work! Sorry for that!
>
> Regards,
> Tamas
>
--
Frank W. Zammetti
Founder and Chief Software Architect
Omnytex Technologies
http://www.omnytex.com
AIM: fzammetti
Yahoo: fzammetti
MSN: fzammetti@hotmail.com
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Tamas Szabo <sz...@gmail.com>.
Hi All,
First of all Wendy, sorry for convincing you to change your Wiki page.
You can change it back if you want to...
Actually I'm totaly confused about this bug I haven't replied earlier
because I
thought that I will set up an apache with ssl here at home so I can find out
what really causes it, but at the moment I don't think that I will spend
time with
this.. after all it's just a stupid bug, it's not that interesting.
So back to the problem:
We have a writePdfToResponse(...) method. This sets the content-type the
content-length and writes the pdf to the response.
This method is called from two Actions one is for GET requests the other is
for POSTs requests.
The same method generates the response for both kind of requests so the
response should be the same in both cases.
For the POST requests I got the "nonsecure items" message box in IE.
On Monday I tried the following things:
1. returned a gif file in the same way --> No "nonsecure items" this time so
it is probably an Acrobat Reader bug.
2. Accessing the page without the open PDF in browser setting. No "nonsecure
items".
3. Wrote a servlet that returns the pdf, mapped it to *.pdf, redirected from
the POST action to the servlet using redirect="true". "nonsecure items"
message box is still there!!! I thougth that this will work because the GET
request doesn't show the "nonsecure items" message box.
4. Used Wendy's approach, sending a html page that hasa meta refresh header.
This worked of course.
But.. the clients didn't like the page an the additional redirect.
So I put back the original code, actually I rewrote it so it is slightly
different and surprise the "nonsecure items" message box is gone!
I checked the older code in subversion and at a first glance it seems I am
doing exactly the same thing. But the message is not there anymore! And I
suddenly lost all my "appetite" to found out the exact circumstances in
which this stupid bug occurs.
So thanks for al your help. Wendy please remove the redirect solution from
your wiki cause it doesn't work! Sorry for that!
Regards,
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by "Frank W. Zammetti" <fz...@omnytex.com>.
Tamas Szabo wrote:
> That's interesting, I didn't know that PDF works just like HTML in this
> matter.
> A coworker wrote the PDF generator so I'm not sure about this, but I tend to
> think that the problem is not caused by this, because then I would get the
> confirmation box when I make a GET request too...
He probably wrote it on top of iText, or some similar package though,
right? If not you should probably smack him next time you see him :)
> The app is a Struts app and the cache headers are set.
> I can try to do this (what is this JWP? hehe), but do you thin that iw
> would be different
> for GET and POST requests?
I wouldn't expect so, but I know your seeing a difference between POST
and GET. That I wouldn't have expected. Actually, I'm not 100% sure
what my app is doing frankly, I'm pretty sure a GET, but I'm going to
have to check on Monday,
> So it is a GET request? :-)
Yep, that's what I meant, I'm not really sure... I haven't looked at
that part of the code in a long time, but I'd actually be surprised if
it WASN'T a GET.
> I tested this only with open in browser setting.
Yeah, I'd say flip it and see if you see any difference. It wouldn't
surprise me if you do.
> I like the Ethereal idea I will try this at first on Monday probably.
> And after that I can try to send back another bytestream(not a PDF) to see
> if the PDF plug-in is the source of the problem or not?
That's definitely a good idea too. Probably the easiest test would be
to stream a GIF off the file system, since you can be all but certain
any browser isn't going to have a problem with that.
One other problem I saw a lot of had to do with network proxies...
that's where Etheral might help... we saw some really wacky things that
were caused by the proxies, so if you have any in the mix I'd cast a
very suspicious eye on them.
Frank
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Tamas Szabo <sz...@gmail.com>.
On 11/26/05, Frank W. Zammetti <fz...@omnytex.com> wrote:
>
> Tamas, do you by chance have custom fonts or images in the PDF that
> might be getting retrieved over a non-secure connection? A PDF works
> just like HTML in that the document is returned, and then the browser
> makes requests for embedded resources, including images and non-standard
> fonts.
That's interesting, I didn't know that PDF works just like HTML in this
matter.
A coworker wrote the PDF generator so I'm not sure about this, but I tend to
think that the problem is not caused by this, because then I would get the
confirmation box when I make a GET request too...
I too had all manner of problems serving PDFs over an SSL connection. I
> don't recall your exact problem though, although it *does* sound familiar.
>
> One problem I remember for sure was the cache headers... do you by
> chance have the controller configured to set them? If so, drop that and
> use the CacheControlFilter in JWP and map it so you *don't* set the
> headers for the URL that you retrieve the PDF with.
The app is a Struts app and the cache headers are set.
I can try to do this (what is this JWP? hehe), but do you thin that iw would
be different
for GET and POST requests?
I have an app in production that streams PDFs back right now, and it's
> actually an IE-only app, so that in and of itself *can* definitely be
> done... Actually, what I do is a bit of a hybrid... I write the PDF to
> a database, and then redirect to an Action that streams it.
So it is a GET request? :-)
The other problem that *always* comes up, which might be harder for you
> to deal with, is in the Acrobat plug-in (which is a buggy piece of s**t
> by the way) there is an option to open PDFs in the browser or not...
> I've had some users that have to be set one way, others that have to be
> set the other, no pattern I can see.
I tested this only with open in browser setting.
One other suggestion is to throw Etheral on the line while retrieving a
> PDF... you just may see what's going on right away. Like I said the PDF
> plug-in is absolutely horrendous, and I'd be willing to bet that's the
> source of your problem, not IE (this time!).
I like the Ethereal idea I will try this at first on Monday probably.
And after that I can try to send back another bytestream(not a PDF) to see
if the PDF plug-in is the source of the problem or not?
Just some other things you might want to check.
Thanks, any tips are welcome
Frank
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by "Frank W. Zammetti" <fz...@omnytex.com>.
Tamas, do you by chance have custom fonts or images in the PDF that
might be getting retrieved over a non-secure connection? A PDF works
just like HTML in that the document is returned, and then the browser
makes requests for embedded resources, including images and non-standard
fonts.
I too had all manner of problems serving PDFs over an SSL connection. I
don't recall your exact problem though, although it *does* sound familiar.
One problem I remember for sure was the cache headers... do you by
chance have the controller configured to set them? If so, drop that and
use the CacheControlFilter in JWP and map it so you *don't* set the
headers for the URL that you retrieve the PDF with.
I have an app in production that streams PDFs back right now, and it's
actually an IE-only app, so that in and of itself *can* definitely be
done... Actually, what I do is a bit of a hybrid... I write the PDF to
a database, and then redirect to an Action that streams it.
The other problem that *always* comes up, which might be harder for you
to deal with, is in the Acrobat plug-in (which is a buggy piece of s**t
by the way) there is an option to open PDFs in the browser or not...
I've had some users that have to be set one way, others that have to be
set the other, no pattern I can see.
One other suggestion is to throw Etheral on the line while retrieving a
PDF... you just may see what's going on right away. Like I said the PDF
plug-in is absolutely horrendous, and I'd be willing to bet that's the
source of your problem, not IE (this time!).
Just some other things you might want to check.
Frank
Wendy Smoak wrote:
> On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
>
>
>>Well, that's why I said that it's a strange behaviour.
>>Because I'm pretty sure that everything goes over ssl in our app too.
>>And I tried executing the exact same code using a GET request and then I
>>don't get the confirmation box.
>
>
> Okay, then I'm pretty sure it *is* the same thing. :) I just didn't
> make a note of the exact error message on the Wiki page.
>
>
>>I still don't understand what do you mean by sending IE some text?
>>Your whole webapp consisted just from a pdf generator?
>
>
> No, but this particular page was intended to be:
> 1. POST form over SSL
> 2. Display the PDF
>
>
>>And if not then why do you say that you sent some text
>>to IE before sending the PDF?
>
>
> Instead of trying to serve the PDF directly in response to the form
> post, I instead forward to a JSP that sends some HTML. That, IE can
> deal with.
>
> I also think it's a bug in IE, but it's not like we can wait around
> for them to fix it. :) If you search the archives either here, on
> tomcat-user or on comp.lang.java you'll probably find the original
> discussion. I don't remember where it was, and it was years ago now,
> but (as usual) I didn't come up with this solution on my own.
>
>
>>I'm not trying to bug you I just want to know the exact circumstances in
>>which this ?error? occurs.
>
>
> You're not bugging me, I'm happy to try to save you the *days* I went
> round and round with this.
>
> The problem seems to occur when a user posts a form over SSL, and you
> try to respond with a PDF. (It might be any binary content, I don't
> know.) The workaround is to respond not with the PDF, but with some
> HTML, in this case a bit of HTML that redirects to a URL where the PDF
> can be found.
>
> Don't hesitate to ask for more clarification-- unfortunately this was
> all so long ago that I'm having trouble coming up with a good
> explanation.
>
> --
> Wendy
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
>
--
Frank W. Zammetti
Founder and Chief Software Architect
Omnytex Technologies
http://www.omnytex.com
AIM: fzammetti
Yahoo: fzammetti
MSN: fzammetti@hotmail.com
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Wendy Smoak <ws...@gmail.com>.
On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
> I just wanna convince you that your wiki page should say that IE
> will show this confirmation dialog if you try to send the PDF file in
> response to a POST request.
>
> To solve the problem you could either
> use GET or if you have to use POST then you could use the trick
> with the redirect.
Thanks. :) I reworked the page and linked to this thread.
--
Wendy
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Tamas Szabo <sz...@gmail.com>.
>
> > I still don't understand what do you mean by sending IE some text?
> > Your whole webapp consisted just from a pdf generator?
>
> No, but this particular page was intended to be:
> 1. POST form over SSL
> 2. Display the PDF
>
> > And if not then why do you say that you sent some text
> > to IE before sending the PDF?
>
> Instead of trying to serve the PDF directly in response to the form
> post, I instead forward to a JSP that sends some HTML. That, IE can
> deal with.
Wendy, the key is that you make this in order to make a GET request
instead of a POST request. I just wanna say that the solution is
not the sending of HTML, the solution is to send the PDF in response
to a GET request. You are not sending _some_ HTML, you send a
_special_ HTML that makes a GET request.
Don't hesitate to ask for more clarification-- unfortunately this was
> all so long ago that I'm having trouble coming up with a good
> explanation.
I think that the picture is clear enough.
I just wanna convince you that your wiki page should say that IE
will show this confirmation dialog if you try to send the PDF file in
response to a POST request. To solve the problem you could either
use GET or if you have to use POST then you could use the trick
with the redirect.
But maybe, I'm a little bit cheeky. First I ask for help and when you offer
your help I respond by criticizing your wiki page ;-)
Thanks for your help,
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by Wendy Smoak <ws...@gmail.com>.
On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
> Well, that's why I said that it's a strange behaviour.
> Because I'm pretty sure that everything goes over ssl in our app too.
> And I tried executing the exact same code using a GET request and then I
> don't get the confirmation box.
Okay, then I'm pretty sure it *is* the same thing. :) I just didn't
make a note of the exact error message on the Wiki page.
> I still don't understand what do you mean by sending IE some text?
> Your whole webapp consisted just from a pdf generator?
No, but this particular page was intended to be:
1. POST form over SSL
2. Display the PDF
> And if not then why do you say that you sent some text
> to IE before sending the PDF?
Instead of trying to serve the PDF directly in response to the form
post, I instead forward to a JSP that sends some HTML. That, IE can
deal with.
I also think it's a bug in IE, but it's not like we can wait around
for them to fix it. :) If you search the archives either here, on
tomcat-user or on comp.lang.java you'll probably find the original
discussion. I don't remember where it was, and it was years ago now,
but (as usual) I didn't come up with this solution on my own.
> I'm not trying to bug you I just want to know the exact circumstances in
> which this ?error? occurs.
You're not bugging me, I'm happy to try to save you the *days* I went
round and round with this.
The problem seems to occur when a user posts a form over SSL, and you
try to respond with a PDF. (It might be any binary content, I don't
know.) The workaround is to respond not with the PDF, but with some
HTML, in this case a bit of HTML that redirects to a URL where the PDF
can be found.
Don't hesitate to ask for more clarification-- unfortunately this was
all so long ago that I'm having trouble coming up with a good
explanation.
--
Wendy
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Tamas Szabo <sz...@gmail.com>.
On 11/26/05, Wendy Smoak <ws...@gmail.com> wrote:
>
> On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
>
> > What do you mean by " In short, you have to send IE some HTML before you
> > send it the bytes of the PDF, or it will complain."?
>
> I'm not entirely sure you're seeing the same problem-- I never get
> 'page contains both secure and nonsecure elements' because everything
> in my apps goes over ssl.
Well, that's why I said that it's a strange behaviour.
Because I'm pretty sure that everything goes over ssl in our app too.
And I tried executing the exact same code using a GET request and then I
don't get
the confirmation box.
> > I think that your solution works because the redirect thing makes a GET
> > request, not because you sent a html page to the browser?
>
> The trick to solving it was to send IE some text before trying to send
> it the bytes of the PDF over ssl. It was so long ago now that I don't
> remember.
I still don't understand what do you mean by sending IE some text?
Your whole webapp consisted just from a pdf generator?
I guess not. And if not then why do you say that you sent some text
to IE before sending the PDF? HTTP is stateless and that redirect
is just another request, so I don't see why should that make a difference.
I mean that the difference should be the GET instead of the POST.
By the way, I think that this is a bug in IE.
> Have you tried to simpy change the method of the form to GET?
>
> No... all the forms are POSTed. It's an age old debate. :) In any
> case it keeps people from bookmarking things they shouldn't. And it
> works, so I'm not touching it now!
Well I can understand that you don't want to touch it! :-)
I'm not trying to bug you I just want to know the exact circumstances in
which this
?error? occurs.
Thanks,
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by Paul Benedict <pa...@yahoo.com>.
That message means you have page in HTTPS but links on that page reffering to (at least one) HTTP.
This is a problem if you have hardcoded the scheme into any of your links.
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Wendy Smoak <ws...@gmail.com>.
On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
> What do you mean by " In short, you have to send IE some HTML before you
> send it the bytes of the PDF, or it will complain."?
I'm not entirely sure you're seeing the same problem-- I never get
'page contains both secure and nonsecure elements' because everything
in my apps goes over ssl.
> I think that your solution works because the redirect thing makes a GET
> request, not because you sent a html page to the browser?
The trick to solving it was to send IE some text before trying to send
it the bytes of the PDF over ssl. It was so long ago now that I don't
remember.
> Have you tried to simpy change the method of the form to GET?
No... all the forms are POSTed. It's an age old debate. :) In any
case it keeps people from bookmarking things they shouldn't. And it
works, so I'm not touching it now!
--
Wendy
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: IE "the page contains both secure and nonsecure items?"
Posted by Tamas Szabo <sz...@gmail.com>.
On 11/26/05, Wendy Smoak <ws...@gmail.com> wrote:
>
> On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
>
> > We have a webapp that generates PDF files on the fly and sends them back
> to
> > the browser.
> > When one accesses the app with https in IE and only in IE they get a
> message
> > box
>
> Been there, done that. :)
Hehe, I thought that I'm not the first...
http://wiki.wsmoak.net/cgi-bin/wiki.pl?NonsecureContent
A few comments:
What do you mean by " In short, you have to send IE some HTML before you
send it the bytes of the PDF, or it will complain."?
I think that your solution works because the redirect thing makes a GET
request, not because you sent a html page to the browser?
Have you tried to simpy change the method of the form to GET?
It's not a solution for me cause I will have to submit a lot of parameters
:-(
So I will have to do something like you suggested:
I will create the PDF in a temp file, put the name of the file in session
and send a redirect which displays the pdf file...
Thanks,
Tamas
Re: IE "the page contains both secure and nonsecure items?"
Posted by Wendy Smoak <ws...@gmail.com>.
On 11/25/05, Tamas Szabo <sz...@gmail.com> wrote:
> We have a webapp that generates PDF files on the fly and sends them back to
> the browser.
> When one accesses the app with https in IE and only in IE they get a message
> box
Been there, done that. :)
http://wiki.wsmoak.net/cgi-bin/wiki.pl?NonsecureContent
--
Wendy
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org