IE5 with friendly error messages set bypasses .htaccess checks

IE5 with friendly error messages set bypasses .htaccess checks

Post by Chris Sai » Fri, 09 Apr 1999 04:00:00




> When using IE4 or Navigator to browze my site, if a file
> is missing or moved, the script I have set up using
> a .htaccess ErrorDocument directive works fine.

> When using IE5, it still works fine as long as I don't
> have the firendly error messages option set.

This is probably due to IE5 intercepting the response code and
displaying its own message in place of what the server returns.
Apache has nothing to do with this, and there isn't anything of
which I'm aware that you can do in Apache to circumvent it.
(After all, it's a client issue, not a server issue.)

--
===============================================================================

PGP Public Key is available at http://www.wtower.com/~csaia/Personal/pubkey.asc
===============================================================================

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Steve Menci » Fri, 09 Apr 1999 04:00:00


Chris,

I'm afraid that's not it. I can give a better example to
explain.

A while back I started using SSI to track web hits using
the AXS scripts. I had to change all of my web pages
from being ".html" to ".shtml". Since all my pages had
already long since been indexed by the search engines,
I wanted a way that the user could be redirected. The obvious
way is to redirect each file individually. However, that is messy.
So, I put could in my error script to see if the file that
was not found ended in ".html". If so, it changes the ending
to ".shtml" and tries again. If found, everything is cool. If not,
then the custom error page is displayed.

However, with "friendly error messages" turned on, the
script never even gets kicked off. You can try to access
http://mencik.com/bs.html both with friendly error messages
on and off to see what I mean.

What you suggest is that the server returns the code, then
the client asks the server if it has an ErrorDocument directive
in .htaccess. I can't believe that is what happens. Perhaps the
server is returning the code to the client, before it finishes
processing (i.e. checking .htaccess), thus the client thinks
the server is done and displays it's own message.

I think that makes it an Apache bug.

Steve Mencik
Mencik's Sportscards
JSweb Technology



> > When using IE4 or Navigator to browze my site, if a file
> > is missing or moved, the script I have set up using
> > a .htaccess ErrorDocument directive works fine.

> > When using IE5, it still works fine as long as I don't
> > have the firendly error messages option set.

> This is probably due to IE5 intercepting the response code and
> displaying its own message in place of what the server returns.
> Apache has nothing to do with this, and there isn't anything of
> which I'm aware that you can do in Apache to circumvent it.
> (After all, it's a client issue, not a server issue.)

> --

============================================================================
===
http://www.wtower.com/~csaia
Quote:> PGP Public Key is available at

http://www.wtower.com/~csaia/Personal/pubkey.asc
============================================================================
===

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by George Girar » Fri, 09 Apr 1999 04:00:00



>When using IE4 or Navigator to browze my site, if a file
>is missing or moved, the script I have set up using
>a .htaccess ErrorDocument directive works fine.

>When using IE5, it still works fine as long as I don't
>have the firendly error messages option set.

>If you would like to try out what I have set up, access
>http://mencik.com/test.html
>That should cause a 404 file not found error.

>Steve Mencik

First it was "favicon.ico" now its this....

I have my own .htaccess file (personal webpage) with ErrorDocument
directives...
That I try to redirect to the 'best' page depending on the requested URL...
Could someone with the "friendly error messages option set" in IE5 try my
site
Don't have any index.htm or any real htm pages for that matter..

just try this link:
http://www.magnolia.net/~georgegg/index.htm
and I hope you will wind up on the page below...

thanks in advance
George Girard, Programmer/FiddlerArounder
I See All.. I Know All.. I Am The Wizard...
http://www.magnolia.net/~georgegg/The.Wizard's.Mysterious.Page

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Robert Hallgr » Fri, 09 Apr 1999 04:00:00



>When I have the friendly error messages option set (which
>is nice to have because many sites don't use the .htaccess
>options), the .htaccess ErrorDocument directives are skipped.

Just make sure the custom error page is larger in file size than 512
bytes. IE5's "friendly HTTP error messages" function looks at the file
size to determine what to do -- showing the actual error page or
supplying its own.

http://support.microsoft.com/support/kb/articles/q218/1/55.asp

Robert

--

PGP: <http://www.lipogram.com/pgpkey.asc>

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Alan J. Flavel » Sat, 10 Apr 1999 04:00:00



> Just make sure the custom error page is larger in file size than 512
> bytes. IE5's "friendly HTTP error messages" function looks at the file
> size to determine what to do -- showing the actual error page or
> supplying its own.

Which published Internet specification did they find that gave them any
excuse for _that_ bizarre behaviour?

Quote:> http://support.microsoft.com/support/kb/articles/q218/1/55.asp

With one hand they give (decent specification-compatible CSS support,
for example) while with the other they take away (_still_ won't handle
HTTP content-types in accordance with the published IETF protocol;  and
now this).

<Sigh size=big>

--

                'You cannot put "The Internet" into the Recycle Bin.'

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by John Hasca » Sat, 10 Apr 1999 04:00:00




}
}> Just make sure the custom error page is larger in file size than 512
}> bytes. IE5's "friendly HTTP error messages" function looks at the file
}> size to determine what to do -- showing the actual error page or
}> supplying its own.
}
}It would be REALLY good if this was all through the Apache documentation (and
}default distributed configs) when talking about ErrorDocument...

    Perhaps Apache needs a 'BrowserMatch' which pads all
    ErrorDocuments with blanks to an adequate size :)

John
--
John Hascall, Software Engr.      Shut up, be happy.  The conveniences you
ISU Computation Center            demanded are now mandatory. -Jello Biafra

http://www.cc.iastate.edu/staff/systems/john/index.html  <=- the usual crud

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Ron Klatchk » Sat, 10 Apr 1999 04:00:00



> When using IE4 or Navigator to browze my site, if a file
> is missing or moved, the script I have set up using
> a .htaccess ErrorDocument directive works fine.

> When using IE5, it still works fine as long as I don't
> have the firendly error messages option set.

> When I have the friendly error messages option set (which
> is nice to have because many sites don't use the .htaccess
> options), the .htaccess ErrorDocument directives are skipped.

Using ErrorDocument does not change the HTTP status code returned.  This
is the behaviour you want so automated retrievals can properly react to
the status code.  ErrorDocument is simply about presenting a more
informative message to the user.

My guess is that your script is still being run, but when IE sees the
error status code it ignores the document that you send and replaces it
with its own.  You could test this theory by having your error script
keep a log of every time it is called (I would test it myself but I
don't have IE5 and don't plan on installing it).

moo
----------------------------------------------------------------------
          Ron Klatchko - Manager, Advanced Technology Group          
           UCSF Library and Center for Knowledge Management          

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Sevo Still » Sat, 10 Apr 1999 04:00:00



> Chris,

> I'm afraid that's not it. I can give a better example to
> explain.

> A while back I started using SSI to track web hits using
> the AXS scripts. I had to change all of my web pages
> from being ".html" to ".shtml". Since all my pages had
> already long since been indexed by the search engines,
> I wanted a way that the user could be redirected. The obvious
> way is to redirect each file individually. However, that is messy.
> So, I put could in my error script to see if the file that
> was not found ended in ".html". If so, it changes the ending
> to ".shtml" and tries again. If found, everything is cool. If not,
> then the custom error page is displayed.

> However, with "friendly error messages" turned on, the
> script never even gets kicked off.

Your error message is 165 bytes long. IE5 ignores error messages shorter
than 512 bytes. That your error message tries to redirect to bs.shtml
through a HTTP-EQUIV Refresh META does not bother MSIE. By the way, your
method will fail its objective to get updated links into the search
engines, as probably none of them will follow a refresh META. You should
verify the availability of the .shtml file locally, and either
immediately send a permanent redirect, or issue a error page (of more
than 512 bytes length, if you want to stay clear of MSIE's evil
"friendly" magic).  

Quote:> What you suggest is that the server returns the code, then
> the client asks the server if it has an ErrorDocument directive
> in .htaccess. I can't believe that is what happens.

It certainly is not happening in your case. And it generally should not
be done - redirection to a error page will diossociate the error status
from the object where the error actually occured, and creates
significant problems for proxies and search engines.

Quote:> I think that makes it an Apache bug.

No. See above. And file a complaint with Microsoft.

Sevo

--
Sevo Stille

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Kees J B » Sat, 10 Apr 1999 04:00:00





>> When I have the friendly error messages option set (which
>> is nice to have because many sites don't use the .htaccess
>> options), the .htaccess ErrorDocument directives are skipped.

>Using ErrorDocument does not change the HTTP status code returned.  This
>is the behaviour you want so automated retrievals can properly react to
>the status code.  ErrorDocument is simply about presenting a more
>informative message to the user.

Isn't it possible to change the status code using the Status: header
from the error script?  Something like this:

        Status: 302 Suffix fix
        Location: http://xxx/yyy.shtml

        <!-- Usual bit of HTML for extinct browsers. -->

--
Kees J. Bot, Systems Programmer, Sciences dept., Vrije Universiteit Amsterdam

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Steve Menci » Sat, 10 Apr 1999 04:00:00


Thanks for everyone's help!

What I did to solve the problem was 2 things.
First I changed from a META refresh to the more proper
"Status 302 \r  Location: $new_url" format for the
file which I wish to redirect.

Secondly, for the files which I just want to give my error
file, I change the status to 200 to tell the client that it
was successful. I know this screws up the search engines
because of the status change, but at least I always get
my message posted, instead of Microsoft's, without having
to artificially pad my error message to more than 512 bytes.

Steve Mencik






> >> When I have the friendly error messages option set (which
> >> is nice to have because many sites don't use the .htaccess
> >> options), the .htaccess ErrorDocument directives are skipped.

> >Using ErrorDocument does not change the HTTP status code returned.  This
> >is the behaviour you want so automated retrievals can properly react to
> >the status code.  ErrorDocument is simply about presenting a more
> >informative message to the user.

> Isn't it possible to change the status code using the Status: header
> from the error script?  Something like this:

> Status: 302 Suffix fix
> Location: http://xxx/yyy.shtml

> <!-- Usual bit of HTML for extinct browsers. -->

> --
> Kees J. Bot, Systems Programmer, Sciences dept., Vrije Universiteit

Amsterdam
 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Peter » Sun, 11 Apr 1999 04:00:00



> Secondly, for the files which I just want to give my error
> file, I change the status to 200 to tell the client that it
> was successful. I know this screws up the search engines
> because of the status change, but at least I always get
> my message posted, instead of Microsoft's, without having
> to artificially pad my error message to more than 512 bytes.

Hmm, your log file analysis will really like that, I'm sure.

Thanks, Microsoft.

--
Q: How could China track down and punish dissidents more effectively?
A: The new Pentium III chip!  http://www.privacy.org/bigbrotherinside/
    Intel doesn't care about your privacy. Join the boycott today.

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by George Girar » Sun, 11 Apr 1999 04:00:00




>> Secondly, for the files which I just want to give my error
>> file, I change the status to 200 to tell the client that it
>> was successful. I know this screws up the search engines
>> because of the status change, but at least I always get
>> my message posted, instead of Microsoft's, without having
>> to artificially pad my error message to more than 512 bytes.

>Hmm, your log file analysis will really like that, I'm sure.

I only have a personal webpage, and I use .htaccess
ErrorDocument 404 http//www.magnolia.net/~georgegg/ path to error handler
script

IE5 gets my error page when the "friendly error" message thing is set,
IF it is not send to the best match page

I do mine a little different, send a status 301 and a location to a
best match file or a default "not found page"

And I also write my own log files so the log analysis comes out ok...

http://www.magnolia.net/~georgegg/IE5-friendly-error-message-test
doesn't exist so you get my main page..
The, Wiz, My, Page, main, index, mast, george, start, home, html, shtm,
shtml,
friendly-error-message, friendly-error, -error-message, IE5-, etc....
included as a file request in the URL should also send you to main page.....

error log will show file requested and page sent to...
log file will show standard log format...

Apache .htaccess works ok for me...
and I send you a fake .htaccess if you request it also :-)

Aren't computers fun
George Girard, Programmer/FiddlerArounder
I See All.. I Know All.. I Am The Wizard...
http://www.magnolia.net/~georgegg/The.Wizard's.Mysterious.Page

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Reinier Pos » Tue, 13 Apr 1999 04:00:00


[clear explanation of the problem deleted]

Quote:>I think that makes it an Apache bug.

  Steve,

It doesn't.  Sevo Stille and others have explained what's happening,
but they didn't make it clear that you're ignoring the HTTP protocol.

Webservers use the HTTP protocol: the client (browser) sends an HTTP
request and receives an HTTP response.  HTTP responses include a
3-digit status code, which defines whether the response is a valid
document, a redirection, an error, or something else.  Document bodies
can be attached to redirections and errors, but the client may ignore
them; after all, they do not represent successfully retrieved
documents.  This is in section 6.1.1 of the HTTP 1.1 specification
(RFC 2068, at

  http://www.dc.luth.se/doc/rfc/rfc2068.txt

or elsewhere).  Therefore, MSIE is perfectly free to ignore
the contents of error documents.

Every document returned by the webserver contains such a status code
and a couple of headers to indicate the file type, size, etcetera.
The HTTP-EQUIV construct you're using is an attempt to override the
HTTP status code or a HTTP document header from within the document
body.  It basically says "please, dear browser, I know I specified
a status code and some document headers, but I lied, use this instead".

In your case: you are serving an error message, but in its body (which
MSIE is free to ignore) you try to turn it into a redirection.

Netscape invented this workaround to circumvent the problem that many
of us cannot specify the actual document headers, or don't know how.
Most browsers now try to use this information, but it will always
be a hack: nothing in the HTTP protocol requires that it is used.

The HTTP status code and document headers are product information.
Product information is supposed to be on the cover; it cannot be
overridden by notes found inside.  The HTTP-EQUIV hack tries to do
exactly that.  Using it is like selling pre-packaged apple pies,
properly labeled, with small notes inside the pie: 'best before
end 1991 is what the package says, please correct that to 2001'
or 'warning: contains lethal dosis of strychnine, do not eat'.
These notes may never reach the customer.

The proper solution is the alternative you mentioned.  For example,
to redirect all *.html files on the server to =.shtml, use

  RedirectMatch /(.*)\.html http://svwww1:8080/$1.shtml

(To be honest: I didn't know this, but it's explained in the manual.)

--

 
 
 

IE5 with friendly error messages set bypasses .htaccess checks

Post by Ron Klatchk » Fri, 16 Apr 1999 04:00:00



> What you suggest is that the server returns the code, then
> the client asks the server if it has an ErrorDocument directive
> in .htaccess. I can't believe that is what happens. Perhaps the
> server is returning the code to the client, before it finishes
> processing (i.e. checking .htaccess), thus the client thinks
> the server is done and displays it's own message.

> I think that makes it an Apache bug.

First of all, the scenario you described where the server returns a code
and then the client asks the server if it has an ErrorDocument is not at
all how HTTP works.

All HTTP requests are simple request/response sequences.  A client
issues a request and a server returns a response and then it is done.
If the response includes HTML that has tags for other embedded data
(such as images), then the client will start issuing new requests, but
that is a moot point for this discussion.

When Apache is handling a request and gets some sort of error, it
internally consults the list of ErrorDocuments prior to returning any
response.  If it sees an appropriate ErrorDocument directive, it returns
a response that contains the original status code (important for spiders
and other automated clients) and the contents of the ErrorDocument URL
(useful for humans sitting at a browser).  If a browser chooses to look
at the error code and ignore the contents, there is nothing the server
can do about it.

If you don't believe me, I have two suggestions of how you can prove
this to yourself.

1) Use a network sniffer and watch the traffic between the client and
the server on such a request.  If you look at the data coming back from
the server, you'll see the contents of your ErrorDocument CGI but still
see IE show it's internal "friendly" error message.

2) Have your ErrorDocument CGI log every time it runs and some client
information (such as HTTP_USER_AGENT and REMOTE_HOST) to a file on your
server.  You'll see that your CGI was run for the request even though
your browser doesn't show the information it returned.

moo
----------------------------------------------------------------------
          Ron Klatchko - Manager, Advanced Technology Group          
           UCSF Library and Center for Knowledge Management