IE/SSL File upload failure

[George DeStefano]

Using Internet Explorer to upload files to my secure
website often fails.

It fails about 40% of the time when I am uploading files
from the C drive of the system running Internet Explorer.
It fails about 100% of the time when I am uploading files
from a mapped network drive. When it fails while I am
uploading files from the C drive and I immediately try
again with the same file it usually works on the second
attempt.

Using a different browser, these uploads never fail.

My website implements the upload using the standard html
form as described in typical/popular HTML "How to" books.

I am running Internet Explorer Version 6.0.2800.1106C0
with Update Versions SP1; Q824145; Q832894; Q837009;
Q831167.

My website is deployed to a WebSphere 5.1 server.

When it fails, the browser posts a message indicating that
The page cannot be displayed, and suggests several things I
might try, such as try again later, or adjust my browser
connection settings or security settings. As noted
above "try again later" sometimes works.

Moving the upload to a non-SSL URL, changing to a
different web server, and changing to a different browser
are not options I can take.

This problem seems similar to the login form posting
problem fixed in Q831167. Is work underway to fix this
upload problem?

 

[George DeStefano]

This is an update as much as a reply ...

After reading some posts and workarounds for different,
but somewhat similar problems, I tried adding custom
properties for ConnectionIOTimeout and
ConnectionKeepAliveTimeout on the transport for my
application's SSL port. I set both values to 120. With
these properties set, the uploads have not failed. Can
anyone explain why these values for these properties have
this effect?

 

[George DeStefano]

Any advice or opinions on setting these values to 120?
Are there security exposures or other issues I might
minimize by choosing smaller values that still prevent my
original problem?

 

[Guest]

Also .... this occurs when using SSL for CONFIDENTIAL
transport, not for client authentication.