[cobalt-users] http_referer, IE and SSL sites

[Brian Rahill <cobalt@xxxxxxxxxxxxxxxxxxxxxxx>]

Hi All,

I have a very strange problem that only seems to occur with my SSL sites 
when people visit them with IE.

This problem has only appeared in the last couple of months -- perhaps 
after a recent Cobalt Apache or SSL patch.

I have a shopping cart installed (Merchant Order Form). As I understand it, 
it uses http_referer to send data from one page to the next in the checkout 
process.

Recently it started failing during the SSL part of the checkout process 
with IE browsers (works fine with Netscape and Mozilla). Basically, it 
looks like the http_referer isn't passed.

However it only fails about 50% of the time and if I hit my back button and 
resubmit, usually it goes through the second or third time.

I'm well aware of the IE bud that causes 404 errors on SSL sites and I have 
corrected this with the following in the httpd.config for the ssl site:
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

The developer of the cart has said that another user on a Cobalt complained 
of the same behavior.
I've also seen similar behavior using the OpenSRS client on my SSL sites -- 
it fails about 50% of the time due to the same issues.

Has anyone else seen recent problems with http_referer (or form submits for 
that matter) with IE and SSL sites?

Thank you all for any help you can provide.

Brian