Recently a customer was trying to integrate with WorkSite Web by using ViewDoc.aspx to view documents in native format. They found that typing the URL into the browser's address bar produced an error (see attached screen shot). I was able to reproduce the error with IE7 and WorkSite Web 8.2 SP1.
My research unconvered an issue in IE ("Internet Explorer file downloads over SSL do not work with the cache control headers"
http://support.microsoft.com/kb/323308/). I’m using IE 7 and applied the suggested registry changes for IE 6 SP1 in this KB article and was able to get my ViewDoc.aspx call to work from the IE address bar. I'd also like to point out that while the article title states the issue is with SSL, it is also a problem with standard HTTP traffic. I'd like to take a moment to explain how this affects integration with WorkSite Web.
As a security measure, by default we turn off HTTP caching in out-of-box WorkSite Web to prevent sensitive documents from being stored in a cache. We do this by setting three headers: “cache-control:no-cache”, “expires:-1”, “pragma:no-cache”. The headers are honored by any caching mechanism, whether it be the browser’s local cache or a proxy machine elsewhere on the internet. The problem is that IE requires “active content” (Word, Excel, PDF) to be cached on the client machine in order for it to be opened.
At this point you have two options to fix this: 1) Apply the workaround as suggested in the aforementioned article to all browsers accessing ViewDoc.aspx from an external link. 2) Enable caching in WorkSite Web. You need to set the “enable-caching” flag in <wsw_install>/data/options.xml to “1”. Below is a table summarizing these options along with the advantages and caveats I see for each workaround.
| Workaround | Pro(s) | Con(s) |
| Make registry settings as recommended in KB article | Documents will not be cached on user’s machine or intermediate proxy machines (highest form of security). | One-time administration headache – may not be if admin can make change using some sort of deployment tool. |
| Set enable-caching = 1 in options.xml in WorkSite Web | - No need to configure user machines (lowest form of security).
- Easiest to implement.
- Best used when ViewDoc.aspx links are only being accessed from an intranet.
| - WorkSite Web sets cache-control header to “public”, does not set expires or pragma headers.
- Documents are effectively stored in browser’s cache and potentially in other proxy machines elsewhere on the internet.
|
| [Optional] Force IE to remove temp files when browser closed. (In IE, go to Tools --> Internet Optons --> Advanced tab) | When used in conjunction with the options flag, this will remove temp files from the user’s cache (some security). | - No way to remove file from proxy machines on the internet (if applicable).
- Potential admin headache to change browser settings.
- Static content, like JavaScript, images and persisted cookies will always be lost on closing the browser.
- Affects all sites the user visits, not just WorkSite.
|
Below is the options node from options.xml. You have to manually change the enable-caching flag, as we do not expose this through the UI.
<options debug="0" page-notification="0" ... enable-caching="1">
