Monday, December 19, 2011

RESTful Windows Client

Good tutorial
WCF REST Starter Kit

AWS - Amazon Web Services

Credentials

Monday, December 12, 2011

Certificate error when redirecting http://localhost to https://localhost

On IE, after the certificate error page is shown, clicking "Continue ..." link doesn't work.



  • "http://localhost" is by default is assigned to "Locked-down Local Machine Zone" by Windows (later than XP SP2)
  • When "http://localhost/" is redirected to "https://localhost/", IE detect server SSL certificate error and shows an error page. 
  • This error page is internally has URL "res://ieframe.dll/invalidcert.htm?SSLError=50331648#http://localhost/" and is considered to be in "Internet Zone".
  • "Locked-down Local Machine Zone" by default doesn't allow navigation into its zone from a less privileged zone (e.g. "Internet zone"). Thus clicking continue button is ignored.


Workaround for this problem

  • Acces "https://localhost/". "https://localhost" is by default considered "Local Intranet zone" thus navigating from "res://ieframe" is possible.
  • Access "http://127.0.0.1/". "http://127.0.0.1/" is by default considered "Internet zone" thus navigating from "res://ieframe" is possible.
  • Add "http://localhost" to "Trusted Zone". "Trusted Zone" allows navigation from "Internet Zione" thus navigating from "res://ieframe" is possible. 
  • Using Group policy editor (gpedit.msc), edit User Configuration - Administrative Templates - Windows Components - Internet Explorer - Internet Control Panel - Security Page - Locked-down Local Machine Zone, and set "Web sites in less privileged Web content zones can navigate into this zone" to Enabled (don't forget to set the Options part inside the dialog to "Enabled" too).


Notes: Adding "http://localhost" to "Trusted zone" (or any other zones) internally remove it from "Locked-down Local Machine Zone". If "http://localhost" is afterwards removed from "Trusted zone", it will no longer explicitly bound to any zone and will be considered to belong to "Internet zone". Thus the problem reported here won't reappear after the removal.