Writing office documents over HTTPS

I love computers. Every job you do, every bit of code you write, no matter how simple or complex, you learn something new somewhere along the way.

And today was no exception. I had to deploy an update to our company's extranet. it was a fairly thorny one because the database schema had changed enough to make it an issue, well, the whole application had changed enough to make it an issue. Anyway, one of these new features was customer reporting. Nothing too exciting, you pick a date range, runa a SQL query and spit out the results. But we also provide a nice pretty formatted export to Excel using an in-house developed SpreadsheetML library, and write it out to the response.

The usual stuff, I'm sure we've all been there:

response.ContentType = "application/vnd.ms-excel";
response.AddHeader("Content-Disposition", "attachment; filename=" + filename );

Then, when I deployed it to the live site (at midnight!) it wouldn't work. Strange. It's exactly the same code. It's writing text to the response (XML) and setting a content type. That's it really, so why wouldn't it work?

Luckily, I found This KB article.
Turns out that Office documents don't download over HTTPS because, Quote:

In order for Internet Explorer to open documents in Office (or any out-of-process, ActiveX document server), Internet Explorer must save the file to the local cache directory and ask the associated application to load the file by using IPersistFile::Load. If the file is not stored to disk, this operation fails. When Internet Explorer communicates with a secure Web site through SSL, Internet Explorer enforces any no-cache request. If the header or headers are present, Internet Explorer does not cache the file. Consequently, Office cannot open the file.

Well, blow me down!

So, I added this line before doing anything else, and bingo!

response.ClearHeaders();

I mean, it figures and all, but I'd really rather not have found this out at half past 12 in the morning, instead of trying to get some sleep! I bet I'm the last person in the web world to find this out too. Bah.