Customer Support

My SSL bank site kept either timing out or telling me I had clicked the
back button on my browser, i am using AOL browser, patch 831167 sorted
it.

From a post at
http://www.mail-archive.com/discuss-list@opensrs.org/msg24118.html 
a reported server-side fix is to put this line in a file named .htaccess
that is located in the same directory as, or above the directory where
you are serving pages:

      SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0

That statement would go all on 1 line, even though it may appear to wrap
on multiple lines in this note.

Microsoft have just released this months patches on Windows Update, but
have not released Q831167 yet, so machines that patch only from Windows
Update will still be flawed.

The .htaccess fix didn't work for us.  We're on SunOS at your-site.com. 
As far as I know, we're not on a secure site, either.  I'm just posting
plain-old HTML form data to a PHP page.  I have it stripped down to bare
essentials, and still get the problem about 50% of the time.  Removing
the offending MS Security patch does fix the problem, as does applying
the patch-fix patch.  It's incredibly galling that MS has not called
this a critical problem and pushed the patch out to users.  

"Empty Content-Length on POST from Internet Explorer"
http://telanis.cns.ualberta.ca/

This bug is still present in the newest build of Internet Explorer (With
Service Pack 2, as of the date of writing). This time the bug appears
when the submitting form contains a file upload. 
A normal post without encoded data doesn't result in the display of an
empty page.
The problem can be fixed by applying the NoKeepAlive setting to Apache
for SSL connections.

And As of 5-9-06, with the most recent IE updates, it\'s still broken...
 Go IE!!

My specific issue was that uploading files behind ssl in Internet
Explorer would first display a blank page, upload the file, then return
my response \"thank you\" page.   I think the orginal problem was that
IE would post <nothing> to the server -- My hunch is that the \"quick
fix\" for the developers of IE was to simply send the post again after
the \"broken\" post.  So you get the non-post headers, a blank page is
returned, then the browser reposts to correct the problem.  Needless to
say, users think the upload broke as soon as they hit the blank page. 
Thanks a lot, Microsoft!

This fixed it:
In apache\'s httpd.conf file, find: 

# The following directives modify normal HTTP response behavior to
# handle known problems with browser implementations.
#
BrowserMatch \"Mozilla/2\" nokeepalive
BrowserMatch \"MSIE 4\\.0b2;\" nokeepalive downgrade-1.0
force-response-1.0
BrowserMatch \"RealPlayer 4\\.0\" force-response-1.0
BrowserMatch \"Java/1\\.0\" force-response-1.0
BrowserMatch \"JDK/1\\.0\" force-response-1.0

(occurs around line 950 or so in my file)
Add the line:

SetEnvIf User-Agent \".*MSIE.*\" nokeepalive ssl-unclean-shutdown

You must have mod_setenvif enabled in apache for this to work.

We are having this same problem.

The caveat with setting the keepalive off is that all web pages generate
huge connection counts and impact on web server performance.

There must be a better way around this.

I can't believe that MS has been ignoring this for 4 years now...

This problem can also appear if you are using IIS with client
certificates. See this article for how to resolve this:

http://tinyurl.com/ynnzqh