JDK-6256473 : To download an applet does not finish for 10 minutes with proxy server and IIS
  • Type: Bug
  • Component: deploy
  • Sub-Component: plugin
  • Affected Version: 1.4.2_05
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: windows_xp
  • CPU: x86
  • Submitted: 2005-04-18
  • Updated: 2010-08-03
  • Resolved: 2005-10-19
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
Other JDK 6
1.4.2_14Fixed 6 b50Fixed
Related Reports
Relates :  
Relates :  
Description
1. Phenomenon
   It happens that downloading an applet does not finish and browser can not be controlled.
   After 10 minutes or so, the browser recovers.

2. Investigation
  When we try to display the HTML which uses an applet in IE, downloading the applet
  never finishes and the browser can not be controlled.
  After the time of no-response-time-out in proxy server(10 minutes or so) has passed,
  the browser recovers.

  According to our investigation for communication data in packet-capturing, our issue
  seems CR#6205816.

 REPRODUCIBLE CONDITION:
   (1) Using JRE 1.4.2_05 or subsequent versions ( we confirmed this occurs in 1.4.2_08
        and 5.0fcs also )
        Note :
           In JRE1.4.2_04 or previous versions, this issue does not occur.
   (2) Web site communicates in HTTPS(SSL). When web site uses HTTP(non-SSL),
        this issue does not occur.
   (3) There is a proxy server on communication path between web server and client
        and the proxy passes the incorrect sequence data from JRE to web server
        We confirmed this issue occurs in the following  proxy servers.
            - Squid
            - DeleGate
            - SwiftProxy

   We will show the message sequence on applet initialization in fig.1 in the attached 
   file(com-sequence.ppt)
   On applet initialization, JRE tries to download the applet.
   JRE sends the request in HTTPS protocol  to connect to the web server(IIS) in order to
   download the applet.( 1) in fig.1). This environment needs proxy certificate. Then the proxy
   serve returns the request for certificate to the client.( 2) in fig.1)
   
   Usually, the protocol sequence should be as 6) - 8) in fig1. 
   However, in our environment,
      i) JRE sends incorrect HTTP data(non-SSL) to the proxy ( 3) in fig.1)  
      ii) The proxy sends that to the web server. 
      iii) The web server considers incorrect sequence data and discards.
      iv) The proxy server never sends any response to the client(JRE)  
           because the web server does not replies.
      v)  The client stays silent and un-controllable between the above iii) and iv).
      vi) After no-response time occurs at the web server, time-out message is sent to 
          the client thru the proxy.
      vii) After vi), the client can download the applet.

====================================================================
 More information to construct environment.

1. Overview
  When we connect to IIS(using SSL) through a proxy server and try to
  download an applet, downloading consumes too much time.
  The following shows how to reproduce the issue.

2. To Construct Reproducing Environment

   2.1 Setting IIS(SSL)
      We should do "Creating site" and "Setting SSL".As to other setting, 
      we use the default value.

      2.1.1 Creating site
        (1) Invoke IIS manager and then create a new Web server.
        (2) Deploy the following 3 file in local path of the new Web server
            - err.html
            - sample-jar.html
            - samle.jar
      2.1.2 Setting SSL
        (1) Request for server certificate and install the created certificate to IIS
        (2) Set the SSL port to "443"

  2.2 Setting Delegation
     Launch the following command to start service
     >dg8_11_2 -P8080 SERVER=http AUTH=proxy:pauth AUTH=origin:auth AUTHORIZER=XXX PERMIT=http:*:+=users TIMEOUT=io:30
     (XXX : Server Name)


3. How to reproduce
  (1) Open the Setting proxy server in Internet Explore and set the port number to
       8080 which is set on delegation setting
  (2) Open  err.html at IIS(SSL) server through IE
      ( ex. : https://XXX/err.html )
  (3) How to check whether the problem occurs or not is
         The IE browser stays white after delegation and the next screen for authentication
         never shows up.
         This status show our issue occurs.

4. Note

  When we launched the command for delegation, the attached file(MSG-on-DOS-prompt.txt)
  showed up.
###@###.### 2005-04-18 10:13:32 GMT
NOTE:  This problem occurs for all conection methods not just when using a proxy server.

Comments
SUGGESTED FIX http://web-east.east/www/webrevs/aw158418/6256473/webrev/ http://web-east.east/www/tests/1.6.0/6256473/
09-08-2005

EVALUATION The problem was caused by an HTTP packet that was sent out during authentication. During an HTTPS authentication this command would block util a timeout was reached causing the client to hang.
09-08-2005

WORK AROUND (1) To use JRE1.4.2_04 or previous versions. NOT practical workaround, because JRE1.4.2_04 has the security issue (CAN-2004-1029) (2) Not to use HTTPS(SSL), but HTTP (3) To connect to web server without proxy server ###@###.### 2005-04-18 10:13:32 GMT
18-04-2005