Internet Explorer Can't Open Files Via HTTPS: Try Removing The Pragma Header

While wrapping up a few bugs on one of my latest projects, Onyx, I encountered one of the most annoying and irritating IE nuisances to date.  Let me reiterate my hatred for Internet Explorer.  So here's the deal.  In PHP, I was serving up a few static files nestled away on the web-server.  The user would click a link, my PHP would fopen a file, and send it to the browser.  Simple enough, and this worked just fine on HTTP.  Then, I moved my new web-application to a production environment under HTTPS.  Suddenly, some downloads failed on IE with the following error:

"Internet Explorer cannot download [file] from [server]. Internet Explorer was not able to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later."

Here's a screen shot of the error from IE8:




With a little digging, I tracked down the following support pages on microsoft.com that explain the problem:

• http://support.microsoft.com/kb/316431 -- Internet Explorer is unable to open Office documents from an SSL Web site.
• http://support.microsoft.com/kb/812935 -- "Internet Explorer Cannot Download" Error Message When You Use an HTTPS URL to Open an Office Document or PDF File

It appears that Internet Explorer gets confused when it sees a Pragma and Cache-Control header together in the same response.  And, it has difficulties interpreting these headers properly over HTTPS.  As described on microsoft.com, "when Internet Explorer communicates with a secure Web site through SSL, Internet Explorer enforces any no-cache request. If the header or headers are present, Internet Explorer does not cache the file. Consequently, Office cannot open the file."  And, when you're using sessions in PHP, the PHP engine automatically by default inserts the Expire, Cache-Control, and Pragma headers in your responses as explained here.

In my case, the solution to this issue was to remove the Pragma header in my HTTP response.  In PHP, I forcefully unset the Pragma header with the following code-snippet:

header("Pragma: ");

This successfully clears the Pragma header in my responses, and all is well.  With this tweak, IE7 and 8 correctly handle my file downloads.