Setting NoCache causes IE/Powerpoint to fail to open

[Jonathan Trevor]

Hi,

For the last couple of releases of a product we're developing we've been
running to very wierd behavior from IE and our ASP.NET web application which
serves up various types of files and I'm getting very frustrated in trying
to solve it!

We content we are serving up is potentially sensitive and therefore we DO
NOT want it cached on the remote client (IE) beyond the lifetime of the
application rendering it (IE, Powerpoint, Word etc.). Clearly the user can
mess this up but thats another issue.

So on the request for a file we set:

Response.Cache.SetCacheability(HttpCacheability.No Cache);

- or -

Response.Cache.SetNoStore();
Response.Cache.SetNoServerCaching();

The rest of the headers get set pretty much as you'd expect:
Response.StatusCode=200;
Response.ContentType = fileContentType;
Response.AppendHeader("Content-Length", fileContentLength.ToString());

I've tried as many various on caching options and headers as I can think of
and I can't avoid the following behavior:

For certain types of file, like PowerPoint or Word, clicking on a file href
causes:
* IE prompt for a "what do you want to do with this file?". It has the right
type displayed and name.
* Pressing either of these options then results in a Microsoft Powerpoint
dialog saying "Could not open <fullurl>"
* Clicking ok to that dialog causes IE to display an error "could not
download <whatever.ppt> from <somehost>".
* Looking at the web logs IE does NOT execute any further calls to our
application. The only call we see is the single request for the file which
is returned.

For other types of file, like Jpegs, clicking on the href opens the file
within IE and displays the image correctly.

Right-clicking on the href and selecting "Save as" works.

Setting a context-disposition header doesn't make any difference to the
problem above. Removing the "no-cache" header and letting the private cache
expire after 0 minutes works in all cases above - but the file remains in
the machines cache - something we'd like to avoid.

One hypothesis is that IE first downloads the file to a temporary file,
deletes it (no cache), the asks the user what they want to do with it -
which of course fails (or deletes it after the user chooses before
powerpoint sees it or it can be saved).

What am I missing? Is there any way to set "no-cache" for powerpoint and
succeed in opening it once the IE "save/open" dialog appears?

Thanks
Jonathan

[Eric Lawrence [MSFT]]

In the future, you'll probably want to ask a question like this in one
newsgroup at a time, since it's unclear how many replies you've already
gotten for this question.

This is pretty lame, eh? See
http://support.microsoft.com/default...NoWebContent=1

This refers to SSL delivered documents, but I don't know of any reason this
would only affect SSL.

It's unclear what threats you're trying to mitigate here. Can you
elaborate?

--
Thanks,

Eric Lawrence
Program Manager
Assistance and Worldwide Services

This posting is provided "AS IS" with no warranties, and confers no rights.


"Jonathan Trevor" <tr****@fxpal.com> wrote in message
news:us**************@TK2MSFTNGP09.phx.gbl...

Hi,

For the last couple of releases of a product we're developing we've been
running to very wierd behavior from IE and our ASP.NET web application which serves up various types of files and I'm getting very frustrated in trying
to solve it!

We content we are serving up is potentially sensitive and therefore we DO
NOT want it cached on the remote client (IE) beyond the lifetime of the
application rendering it (IE, Powerpoint, Word etc.). Clearly the user can
mess this up but thats another issue.

So on the request for a file we set:

Response.Cache.SetCacheability(HttpCacheability.No Cache);

- or -

Response.Cache.SetNoStore();
Response.Cache.SetNoServerCaching();

The rest of the headers get set pretty much as you'd expect:
Response.StatusCode=200;
Response.ContentType = fileContentType;
Response.AppendHeader("Content-Length", fileContentLength.ToString());

I've tried as many various on caching options and headers as I can think of and I can't avoid the following behavior:

For certain types of file, like PowerPoint or Word, clicking on a file href causes:
* IE prompt for a "what do you want to do with this file?". It has the right type displayed and name.
* Pressing either of these options then results in a Microsoft Powerpoint
dialog saying "Could not open <fullurl>"
* Clicking ok to that dialog causes IE to display an error "could not
download <whatever.ppt> from <somehost>".
* Looking at the web logs IE does NOT execute any further calls to our
application. The only call we see is the single request for the file which
is returned.

For other types of file, like Jpegs, clicking on the href opens the file
within IE and displays the image correctly.

Right-clicking on the href and selecting "Save as" works.

Setting a context-disposition header doesn't make any difference to the
problem above. Removing the "no-cache" header and letting the private cache expire after 0 minutes works in all cases above - but the file remains in
the machines cache - something we'd like to avoid.

One hypothesis is that IE first downloads the file to a temporary file,
deletes it (no cache), the asks the user what they want to do with it -
which of course fails (or deletes it after the user chooses before
powerpoint sees it or it can be saved).

What am I missing? Is there any way to set "no-cache" for powerpoint and
succeed in opening it once the IE "save/open" dialog appears?

Thanks
Jonathan

[Jonathan Trevor]

Thanks for the pointer.

We're trying to avoid a user leaving copies of private documents on public
machines by accident. Clearly to do this really well you'd need some digital
rights type support (+encryption) or requiring a "trusted" viewer for
documents on that machine which you can guarantee won't leave a copy
anywhere. However, it seemed that setting "no-cache" would be a good way to
allow documents to be viewed on the machine which would then not be
available after the user had left it. If the user made the choice to
download it and then leaves it, then fine (but not good :-) )

While I understand that a temporary file must be created for ppt (etc) to
open (although what they do with webdav is more interesting) I'm not sure
why IE couldn't open powerpoint, and then cleanup after ppt exits -
presumably it does the same for itself when opening large files it can host
(like jpgs which open directly in IE). Even more annoyingly there is no way
to determine what behavior to expect from different browsers/clients - it
depends on what applications are installed, how they integrate with IE, and
even what versions are installed. For example, clicking "open" on some
machines causes powerpoint to launch and on others causes IE to host the
powerpoint document.

Finally, I'm not convinced the behavior is consistent as the "Save As"
choice will fail on the "SaveAs/Open" dialog - but if you right click on the
document link and click "Save as" from the menu then it saves without
problems!

Basically, I'd like some consistent behavior when the user clicks on
"Download this document" - i.e. it should never fail wierdly (such as "Save
As" or "Open" failures).

Jonathan

"Eric Lawrence [MSFT]" <e_********@hotmail.com> wrote in message
news:eD****************@TK2MSFTNGP10.phx.gbl...

In the future, you'll probably want to ask a question like this in one
newsgroup at a time, since it's unclear how many replies you've already
gotten for this question.

This is pretty lame, eh? See
http://support.microsoft.com/default...NoWebContent=1
This refers to SSL delivered documents, but I don't know of any reason this would only affect SSL.

It's unclear what threats you're trying to mitigate here. Can you
elaborate?

--
Thanks,

Eric Lawrence
Program Manager
Assistance and Worldwide Services

This posting is provided "AS IS" with no warranties, and confers no rights.

"Jonathan Trevor" <tr****@fxpal.com> wrote in message
news:us**************@TK2MSFTNGP09.phx.gbl...

Hi,

For the last couple of releases of a product we're developing we've been
running to very wierd behavior from IE and our ASP.NET web application

which

serves up various types of files and I'm getting very frustrated in trying to solve it!

We content we are serving up is potentially sensitive and therefore we DO NOT want it cached on the remote client (IE) beyond the lifetime of the
application rendering it (IE, Powerpoint, Word etc.). Clearly the user can mess this up but thats another issue.

So on the request for a file we set:

Response.Cache.SetCacheability(HttpCacheability.No Cache);

- or -

Response.Cache.SetNoStore();
Response.Cache.SetNoServerCaching();

The rest of the headers get set pretty much as you'd expect:
Response.StatusCode=200;
Response.ContentType = fileContentType;
Response.AppendHeader("Content-Length", fileContentLength.ToString());

I've tried as many various on caching options and headers as I can think

of

and I can't avoid the following behavior:

For certain types of file, like PowerPoint or Word, clicking on a file

href

causes:
* IE prompt for a "what do you want to do with this file?". It has the

right

type displayed and name.
* Pressing either of these options then results in a Microsoft Powerpoint dialog saying "Could not open <fullurl>"
* Clicking ok to that dialog causes IE to display an error "could not
download <whatever.ppt> from <somehost>".
* Looking at the web logs IE does NOT execute any further calls to our
application. The only call we see is the single request for the file which is returned.

For other types of file, like Jpegs, clicking on the href opens the file
within IE and displays the image correctly.

Right-clicking on the href and selecting "Save as" works.

Setting a context-disposition header doesn't make any difference to the
problem above. Removing the "no-cache" header and letting the private

cache

expire after 0 minutes works in all cases above - but the file remains in the machines cache - something we'd like to avoid.

One hypothesis is that IE first downloads the file to a temporary file,
deletes it (no cache), the asks the user what they want to do with it -
which of course fails (or deletes it after the user chooses before
powerpoint sees it or it can be saved).

What am I missing? Is there any way to set "no-cache" for powerpoint and
succeed in opening it once the IE "save/open" dialog appears?

Thanks
Jonathan