CFContent/CFHeader file download attachment error when using SSL

Posted on 2005-05-02
Medium Priority
Last Modified: 2013-12-24

I have the following two lines of code:

<cfheader name="Content-Disposition" value="attachment;filename=#filePre##fromDate#-#toDate#.csv">

<cfcontent type="application/octet-stream" deleteFile="Yes" file="#pathName#\admin\wa_ie\#filePre##fromDate#-#toDate#.csv">      

To push a .csv file to the end user. It works in IE 6.0.2900 under HTTP, and works with Firework under both HTTP & HTTPS. It does NOT work under IE & HTTPS. I've found several references to this being a general problem with IE, but of course, no solutions from MS on the issue.

Is there a way to work around this in CFMX?
Question by:jaxman
LVL 21

Expert Comment

ID: 13913255
well My company could not do this also.
Finally we put the msg that "right click to download the file". I do not think even this issue is solved in CF 7. I have not tried thought yet.
It will be interesting to know if anyone know the answer of this.
LVL 35

Expert Comment

ID: 13913549
IE has several bugs when you introduce HTTPS - such as synamically adding rows to tables did not work on IE on a Mac if you used HTTPS - it worked with HTTP.

For some reason I think there are distinct differences in how IE handles various features with HTTPS vs standard HTTP

Author Comment

ID: 13913848
After hours of searching on google, I discovered the issue:

If you have Pragma: no-cache or Cache-Control: no-cache set, IIS has a known bug that prevents attachment downloads from happening under HTTPS.

Known bug URL:


So, you need to check your HTTPS headers and make sure neither of those are defined. If they are being defined by IIS outside of your application, there is a command line utility you can run


to set the value in IIS if they are defaulting to the wrong values.
[Webinar] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

LVL 21

Expert Comment

ID: 13913858
Another reason is that when you use https browser does not let modify the headers and coldfusion needs to modify the headers to display the inline file. So it is not possible.
LVL 35

Expert Comment

ID: 13918805
SO as you have seen the answer to:

"Is there a way to work around this in CFMX?"

Is no.

Accepted Solution

TimDg earned 2000 total points
ID: 13929788
What is the part that is not working?  IE in HTTPS does not download the file at all, or does it open into the browser like what I've been trying to avoid?

My site runs on HTTPS and has a file that specifically serves other files from non-exposed directoreis, but once I manipulated the headers enough I didn't have any problems having it prompt for download.  My main problem was IE adding a [1] to the filename, but through headers I was also able to work around that.

All of the headers I'm using below were important to get this working correctly:

<cfdirectory action="LIST"
<cfif getfile.size eq "">
      <cflocation url="home.cfm?filenotfound=true" addtoken="false">
<cfheader name="Content-Length" value="#getfile.size#">
<cfheader name="Content-Type" value="application/octet-stream">
<cfheader name="Content-Disposition" value="attachment;filename=#url.file#">
<cfheader name="Content-Location" value="#URLEncodedFormat(url.file)#">

<cfcontent type="application/octet-stream" file="#session.securefiles#\#url.file#">

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: kevp75
Hey folks, 'bout time for me to come around with a little tip. Thanks to IIS 7.5 Extensions and Microsoft (well... really Windows 8, and IIS 8 I guess...), we can now prime our Application Pools, when IIS starts. Now, though it would be nice t…
What You Need to Know when Searching for a Webhost Provider
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
This video tutorial shows you the steps to go through to set up what I believe to be the best email app on the android platform to read Exchange mail.  Get the app on your phone: The first step is to make sure you have the Samsung Email app on your …
Suggested Courses

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question