0

I have a simple CGI script that is working now in production that returns a json object, and so it returns a content type of application/x-javascript. In internet explorer, this file is asked to be downloaded, but i can successfully download it.

the cgi script is perl, and output simple json object

#!/bin/perl print "Cache-control: no-cache\n"; print "Content-type: application/x-javascript\n\n" ; print "var whatever = { .. data here .. }"; 

We are migrating to new servers, and I believe that that apache is set up similarly in both locations.

The problem is, IE now does not successfully download this file. i get this error:

--------------------------- Windows Internet Explorer --------------------------- Internet Explorer cannot download hero.cgi from lpdww554.trcw.us.aexp.com. Internet Explorer was not able to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later. --------------------------- OK --------------------------- 

In debugging, i have tried text/plain, text/html and application/javascript to no avail. when using text, the output shows up properly in IE, but will not execute the javascript in the browser.

This script works in Firefox, and it works on my old server in IE (it downloads the file, does not show in browser). I can't figure out why it's not working on my new server, and i'm sure it's a HTTP header issue. I've posted my headers below.

IE New Script Headers

GET /path/script.cgi HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2; MS-RTC LM 8) Host: newserver.company.com:1091 Connection: Keep-Alive Cookie: (cookie) HTTP/1.1 200 OK Date: Thu, 18 Aug 2011 18:42:56 GMT Server: IBM_HTTP_Server Cache-control: no-cache Expires: 0 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/x-javascript 

IE - Old Script Headers

GET /path/script.cgi HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* Accept-Language: en-us UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.2; MS-RTC LM 8) Host: oldserver.company.com Connection: Keep-Alive Cookie: cookie HTTP/1.1 200 OK Server: IBM_HTTP_Server Content-Type: application/x-javascript Date: Thu, 18 Aug 2011 18:43:39 GMT Connection: keep-alive Cache-Control: no-cache Cache-Control: max-age=86400 Expires: Fri, 19 Aug 2011 18:43:38 GMT 

2 Answers 2

0

Maybe the old domain is in the whitelist of your IE7 whereas the new one is not yet. Check the security/site settings for your old and new domain in IE7.

As it works with your old site, this should not be an issue, however, at least IE6 refuses to load application/javascript and only loads text/javascript, even though it now is deprecated (RFC 4329). No idea about IE7, though.

1
  • thanks for the answer, but i found my own answer. thx Commented Aug 19, 2011 at 1:35
0

Turns out the Transfer-Encoding: chunked header effected this.

Turns out, i had to output a Content-Length: header, this solved the issue. I did this by saving everything to a variable, instead of printing it out directly, then added the content length header based on the Length() of the output.

1
  • Old post but... You have the wrong mime-type. Unsafe. JSON mime-type is text/json . Using a JavaScript mime-type for JSON output is a security risk-- JSON object's are also valid JS objects. Client's will see your output as a JavaScript program. If you're output is loaded into a variable it will be evaluated as JavaScript, which could be used for an RCE exploit, rather than parsed as JSON. Also, if your Answer succeeded, you should have dropped a proof and some code samples, then marked it as Accepted Answer. Sorry for resurrecting the dead, but these are still relevant. Commented Jan 9 at 11:02

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.