Hi guys,
I was given this problem and can't figure it out..
We have a page where you add credit cards. What we do is require a logon.
We verify and set cookies that store encrypted versions of your account id and username. And initialzize session vars to build your account page.
When you click on Add Credit card we encrypt your Account ID in the URL and transfer you to our secure server where
we re- set all the cookie info and re-init all the session vars on the secure server and re-generate your account page showing the add cc form.. the vars are all inited properly because the account form displays right. But when they click submit on the form the page returned in IE is "Page not found.... dns error" BUT this only happens about 25% of the time.. its really odd... and get this NO PROBLEMS IN NETSCAPE. Works everytime in NS. So I was asked why...
I found out here from a Microsoft KB article that corrupted cookies or inappropriate posts can cause this...
we use cflocation but it works in netscape so I don't know if that is an issue.
Major points will be added if the solution is found. I mean major!!!
So lets discuss this guys.
CJ
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I saw a problem with this before. Another user I helped had a similar situation where they were submitting a form to a secure site, and it was 'magically' dropping FORM fields in the process. when they hit refresh, everything was ok.
So, let's start at the beginning. Can you draw us a little ASCII art diagram of each file's logical placement to each other? Ie,
input_page.cfm --> user click's "Add CC"
secure page add_cc.cfm --> user submits form
etc...
I think if you can diagram it, we could take a serious stab at it -- let us know exactly which files are secure and not secure, which pages are form, where cookies are set, etc...
OK this is exactly what happens:
Both secure server and regular server have all the same files and structure (their mirrors because the docroot points to the same directory)
http://account_login.cfm
-> (if authenticated)
http://account.cfm
-> (click on credit card link)
http://view_ credit_card.cfm
-> (click on add credit card)
https://add_credit_card_fo
-> (fill form and click submit)
https://credit_card_pro.cf
[this is the page that fails to show up in IE]
-> user clicks back button and
resubmits... voila works most of the time.
CJ
Seriously, be sure your certificate is correct and you aren't getting any errors there. This is rather like the case I ran into. They had a certificate for www.site.com that they had bought but were using it on dev.site.com which was their dev box. The name the certificate is issued to needs to match that of the machine using it. In this case, it did not. Things sort of worked (not well for IE but fine for Netscape and IE on the Mac).
war77: yes it is.
Dain: I just ran through a trial run on the production site.
First try- worked. Logged out and tried again.. error showed up.. now I am at home on a 28.8 K modem and the page showed up immediately.. didn't even seem to give it a chance to even get to the server.
Now, the certificate warning didn't show up at all.. so that isn't an issue in production.
Now when on the error page.. I hit reload.. and it came up to the logout and then login page...
I had tried replacing cflocations with Meta refreshes.. but made some other changes and it didn't work that well at all.. I will try changing to Meta refreshes only without any other code changes.
Any other ideas/troubleshooting tips.
CJ
Another note on the META refreshes: i usually add a cfabort directly after it so nothing can be executed.
Ok, I think I have an idea. The key word is "logout" -- can you post or email me the logout code? I have been through situations where the logout code removes data that shouldn't be removed. That would explain why hitting reload on the error page works, because either a session or client variable hadn't been set yet.
dain_anderson@yahoo.com
we use cflocation but it works in netscape so I don't know if that is an issue.
Make sure, you ALWAYS add the addToken="yes", otherwise you have the described troubles with IE:
<cflocation url="abc.cfm" addtoken="yes">
It will still fail for customers who have cookies disabled, because CF-Session-Management works with cookies only, unless you add the urlToken to EVERY Link, Form ... in your application.
Regards
Eugen
<cflocation addtoken="yes">
didn't seem to solve the problem...
I tried to use meta refresh and ran into other problems... since CGI.HTTP_REFERRER gets blanked when you referesh.. I had to adjust the code but still not working... It wont transfer me to the secure port... I am working on that...
as far as emailing the files... well I couldn't put together files that would make sense... one file is dependent on another... and so on and so forth.. I would be emailing like 40 files and then without a DB you wouldn't get beyond the first line in any of them...
Still looking for troubleshooting recommendations or anything...
I am sure other people have implemented logging on and going to the secure port and having to maintain that logon... I wonder how they did it???
CJ
OK this is it...
I stripped the damn form so its the following code now:
creditcard_add.cfm:
<FORM action="/account/functions
<TABLE CELLSPACING=0 CELLPADDING=0 BGCOLOR=#pagecolors.cellbg
<TR><TD>
<CFSET add_submit=1><CFSET submit_btn="<input type=submit name=creditcard_add value= Add Credit Card>">
<cfinclude template="creditcard_form.
</TD></TR></TABLE>
</FORM>
creditcard_form.cfm:
<cfinclude template="mod10cctype.cfm"
<cfparam name="Var.required" default="Yes">
<cfparam name="Var.ccnumber" default="">
<cfparam name="Var.cctype" default="">
<cfparam name="Session.ccexpiration
<cfparam name="Session.ccexpiration
<cfparam name="Session.ccholder" default="">
<cfparam name="Session.streetaddr1"
<cfparam name="Session.streetaddr2"
<cfparam name="Session.city" default="">
<cfparam name="Session.state" default="">
<cfparam name="Session.country" default="">
<cfparam name="Session.zip" default="">
<input type="HIDDEN" name="AskCC" value="AskCC">
<CFOUTPUT>
<cfparam name="page_errors_occurred
<CFIF page_errors_occurred IS 1>
<cfinclude template="cc_problem.cfm">
</CFIF>
<TABLE CELLSPACING=0 CELLPADDING=0 BORDER=0>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
<cfif IsDefined("Var.ccid")>
#Var.credit_card_type_desc
<input type="HIDDEN" name="updatecc" value="updatecc">
<cfelse>
<INPUT type="Text" name="ccnumber" value="" validate="creditcard" message="Invalid credit card number" size="19" maxlength="20" autocomplete="OFF">
</cfif>
</FONT>
</TD>
</TR><TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD>
<FONT FACE="#Application.font_fa
<select name="ccexpiration_month">
<cfloop index="M" from="1" to="12">
<cfif Session.ccexpiration_month
<option value="#M#" selected>#M#
<cfelse>
<option value="#M#">#M#
</cfif>
</cfloop>
</select>
<select name="ccexpiration_year">
<cfloop index="Y" from="#Year(Now())#" to="#Evaluate(Year(Now())+
<cfif Session.ccexpiration_year is Y>
<option value="#Y#" selected>#Y#
<cfelse>
<option value="#Y#">#Y#
</cfif>
</cfloop>
</select>
</FONT>
</TD>
</TR>
<TR>
<TD><FONT FACE="#Application.font_fa
</TD>
<TD> </TD
<TD><FONT FACE="#Application.font_fa
<INPUT type="Text" name="ccholder" value="#Session.ccholder#"
</FONT></TD>
</TR>
<TR>
<TD COLSPAN=3><FONT FACE="#Application.font_fa
</TD>
</TR>
<TR>
<TD COLSPAN=3><FONT FACE="#Application.font_fa
This address should match your credit card billing address.
</FONT>
</TD>
</TR>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
</TR>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
</TR>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
</TR>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
If U.S. Military, enter APO/FPO for City.
</FONT></TD>
</TR>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
<cfinclude template="states_select.cf
<select name="state">
<cfloop index="SI" from="1" to="#ArrayLen(Var.States)#
<cfif Var.States[SI] is Session.state>
<option value="#Var.States[SI]#" selected>#Var.States[SI]#
<cfelse>
<option value="#Var.States[SI]#">#
</cfif>
</cfloop>
</select>
</TD>
</TR>
<TR>
<TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
If U.S. Military, select AE, AP or AA from bottom of list for State
</FONT></TD>
</TR>
<TD><FONT FACE="#Application.font_fa
<TD> </TD
<TD><FONT FACE="#Application.font_fa
</TR>
<input type="hidden" name="country" value="USA">
<TR><TD COLSPAN=2></TD><TD>
<CFIF isDefined("add_submit")>
<BR>
<input type="hidden" name="creditcard_add" value="1">
<INPUT TYPE="image" SRC="/images/btn_add_cc.gi
<cfelseif isDefined("edit_submit")>
<BR>
<input type="hidden" name="creditcard_update" value="1">
<INPUT TYPE="image" SRC="/images/btn_edit_cc.g
</CFIF>
</TD></TR></TABLE>
<CFIF page_errors_occurred IS 0>
<cfinclude template="cc_problem.cfm">
</CFIF>
</CFOUTPUT>
creditcard_pro.cfm
This is the file that processes the data and authorizes the card and adds it to the DB.
Now it never gets to this page... and as soon as you hit submit on the creditcard_add.cfm page.. I mean it doesn't even make it to the server.
I found out we are NOT setting any cookies for the secure server... so it is cookie less except CF's usually cfid and cftoken.
Does IE have a problem with secure server and CF Server?
Does the combo of Apache's SSL module, CF Server and IE lead to problems... I am going crazy with this problem...
CJ
After looking at the page, I don't see anything that sticks out that would cause your issue. One suggestion, however, you can try is to make the action an absolute URL:
<FORM action="https://www.server
This is a good one -- I'm not sure what to do from here. Again, it would almost require having the entire app to truly troubleshoot this one.
have a look at this
http://support.microsoft.c
absolute URL made no difference...
ran across an interesting article:
http://support.microsoft.c
exactly the problem except the page is going from a secure form to secure cgi rather than non-secure to secure.
CJ
well, after testing and testing this is what the solution was gotten from the mod_ssl site:
The first reason is that the SSL implementation in some MSIE versions has some subtle bugs related to the HTTP keep-alive facility and the SSL close notify alerts on socket connection close. Additionally the interaction between SSL and HTTP/1.1 features are problematic with some MSIE versions, too. You've to work-around these problems by forcing Apache+mod_ssl+OpenSSL to not use HTTP/1.1, keep-alive connections or sending the SSL close notify messages to MSIE clients. This can be done by using the following directive in your SSL-aware virtual host section:
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
Additionally it is known some MSIE versions have also problems with particular ciphers. Unfortunately one cannot workaround these bugs only for those MSIE particular clients, because the ciphers are already used in the SSL handshake phase. So a MSIE-specific SetEnvIf doesn't work to solve these problems. Instead one has to do more drastic adjustments to the global parameters. But before you decide to do this, make sure your clients really have problems. If not, do not do this, because it affects all(!) your clients, i.e., also your non-MSIE clients.
The next problem is that 56bit export versions of MSIE 5.x browsers have a broken SSLv3 implementation which badly interacts with OpenSSL versions greater than 0.9.4. You can either accept this and force your clients to upgrade their browsers, or you downgrade to OpenSSL 0.9.4 (hmmm), or you can decide to workaround it by accepting the drawback that your workaround will horribly affect also other browsers:
SSLProtocol all -SSLv3
This completely disables the SSLv3 protocol and lets those browsers work. But usually this is an even less acceptable workaround. A more reasonable workaround is to address the problem more closely and disable only the ciphers which cause trouble.
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA
This also lets the broken MSIE versions work, but only removes the newer 56bit TLS ciphers.
Another problem with MSIE 5.x clients is that they refuse to connect to URLs of the form https://12.34.56.78/ (IP-addresses are used instead of the hostname), if the server is using the Server Gated Cryptography (SGC) facility. This can only be avoided by using the fully qualified domain name (FQDN) of the website in hyperlinks instead, because MSIE 5.x has an error in the way it handles the SGC negotiation.
So adding that line solved the problem... there was no problem in the code.
I don't want to delete this question so I am going to have CS reduce its points to zero so people can still see the solution for free.
CJ
Business Accounts
Answer for Membership
by: tleishPosted on 2000-10-05 at 09:10:45ID: 4595529
Troubleshooting...
Is this occuring on IE 4.x, IE 5, or IE5.5 or all the above? I've encountered numerous problems with IE5.5 that worked fine in the other versions.