Apache serving PHP to IE but download to Firefox

[Frank_Rizzo]

This is not my site - one I just visited.

If I view the site in IE it correctly displays PHP pages in the browser. If I view the site in Firefox I get offered to download the PHP file.

This is crazy as I can view their scripts and see stuff such as db connection login and password!

How can this be? What setting in httpd.conf is at fault here?

Clearly this is an example of why webmasters should always check their site in different browsers and not just IE.

[jdMorgan]

.> .. always check their site in different browsers and not just IE.

And also check it here [webmasterworld.com] before going live. :)

I suspect that the php script's output is marked with an incorrect MIME-type. If the script's output is HTML, then the MIME-type should be "text/html". If it is marked as "application/<whatever>", then almost all browsers will try to download it, because it says it's an application -- a program to be executed on the client. This behaviour would be the proper handling of an improper MIME-type.

Internet Explorer, on the other hand, examines the first few bytes of any content retrieved from the Web, and decides, based on that sample analysis, whether the MIME-type is correct. If the stated MIME-type disagrees with the results of its content-sample analysis, IE will use its own results. While in most cases, this makes IE's content-handling a bit more robust, it can "hide" MIME-type problems from the Webmaster.

Try testing with a server headers checker, and let us know what you find.

Jim

[Frank_Rizzo]

Here's the response for the dodgy page:

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Connection: keep-alive
Date: Fri, 24 Feb 2006 17:59:19 GMT
Content-Type: application/octet-stream
Accept-Ranges: bytes
Last-Modified: Fri, 24 Feb 2006 10:53:07 GMT
ETag: "8a5157f3039c61:1058"
Content-Length: 14490

BTW, I should have checked what the site was running before assuming it was apache!

Server: Microsoft-IIS/5.0

[py9jmas]

While in most cases, this makes IE's content-handling a bit more robust

No it doesn't - it makes IE's content-handling to be completely broken. The only time a user-agent may guess the content-type is if there isn't one specified.

RFC 2616 is quite clear on this:

If and only if the media type is not given by a Content-Type field, the recipient MAY attempt to guess the media type via inspection of its content and/or the name extension(s) of the URI used to identify the resource.

[jdMorgan]

Opinions may vary, but in my opinion, IE is a little better at handling mis-marked pages. Not that I'd use it for browsing... :)

Added - And since when has MS paid much attention to standards or RFCs? :(

Obviously, the page in question has an incorrect MIME-type, "application/octet-stream", which is causing the problem with Mozilla-based browsers.

Jim