Secured file download in IE8

[ErieCFMaster]

Ok here's the problem I have some generated PDFs that contain sensitive information that can't live in the web root.

I allow users to view them via a secured admin interface using the following code:

<cfheader name="Content-Disposition" value="inline; filename=Export.pdf">

<cfcontent type="application/pdf" file="#pdfFile#" />

Works fine except when users are running IE8 on XP SP3, these users get a blank screen and nothing happens. Yes, they have acrobat, and so far it has failed on two versions 9 and 10.

So I started to check for browsers and added the following if IE8:

<cfheader name="Content-Disposition" value="attachment; filename=Export.pdf">

<cfcontent type="application/octet-stream" file="#pdfFile#" />

and again it works fine everywhere but IE8 on XP. So I tried mimicing a PHP script using the following:

<cfsetting enablecfoutputonly="yes">

<cffile action="READ" file="#pdfFile#" variable="FileData">

<cfheader NAME="Expires" value="Thu, 19 Nov 1981 08:52:00 GMT">

<cfheader NAME="Cache-Control" value="must-revalidate, post-check=0, pre-check=0">

<cfheader NAME="Cache-Control" value="no-store, no-cache, must-revalidate">

<cfheader NAME="Pragma" value="no-cache">

<cfheader name="Content-Type" value="application/force-download">

<cfheader name="Content-Type" value="application/octet-stream">

<cfheader name="Content-Type" value="application/download">

<cfheader name="Content-Disposition" value="attachment; filename=Export.pdf">

<cfheader name="Content-Transfer-Encoding" value="binary">

<cfoutput>#FileData#</cfoutput>

Still no go. Please if anyone has a solution to make this work in ColdFusion I would appreciate the help!!!

[BKBK]

That usually indicates a problem with the installation of Adobe Reader on Windows XP. Keep your original two-line, cfheader-cfcontent solution. Try the suggestions offered in the Adobe article "Can't open PDF".

[Wilgeno]

Was this ever resolved? I'm digging into similar issues with IE 8 and forcing the PDF to be viewed inline.  Your code looks good and you've tried many variants. I've researched and blogged about downloads with cfheader and cfcontent and so far I have no more info with this and IE8. There are bugs in IE8 with reading Content-Disposition. If the file name contains the string 'attachment' that will cause IE8 to download instead of view inline. I am still research other IE8 bugs.

[Tim Cunningham]

Some work arounds are suggested in this thread:http://forums.adobe.com/thread/792591