http://support.microsoft.com/default.aspx?scid=kb;en-us;812935

However, in order to resolve this issue for environments using older IE installations, the attached class will not apply the 'No-Cache' headers to a secure request to download an attachment:

../com/atlassian/jira/web/filters/JIRAEncodingFilter.class

<security-constraint>
      <web-resource-collection>
        <web-resource-name>login</web-resource-name>
        <url-pattern>/</url-pattern>
      </web-resource-collection>
      <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
</security-constraint>

Then you will get this error even in 3.3.3 and above. Please restrict only the login pages, as specified in the documentation

<Valve className="org.apache.catalina.authenticator.NonLoginAuthenticator"
disableProxyCaching="false" />

That patch has been part of JIRA since 3.4. You shouldn't be patching JIRA 3.5.x with it (although it shouldn't hurt). https attachments in IE6 should be working. Please try the attachments on this public instance:

https://issues.apache.org/jira/browse/TAPESTRY-112

If you are having problems it's a different issue to this one - please raise an issue at https://support.atlassian.com

Cheers,
Jeff

• Add the following to Tomcat's conf/server.xml just before the </Engine> tag is closed:

  <Valve className="org.apache.catalina.valves.RequestDumperValve"/>

• Then restart Tomcat. You should see a lot of information in logs/catalina.out file about each request and response.
• Could you request the attachment using IE and attach a zipped copy of the catalina.out file to this issue.

Thanks,
Dylan

Can you try modifying the web.xml file to have the following security-constraint section:

<security-constraint>
      <web-resource-collection>
        <web-resource-name>all</web-resource-name>
        <url-pattern>*.js</url-pattern>
          <url-pattern>*.jsp</url-pattern>
          <url-pattern>*.jspa</url-pattern>
          <url-pattern>*.css</url-pattern>
        <url-pattern>/browse/*</url-pattern>
      </web-resource-collection>
      <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
    </security-constraint>

With this in place, all URLs should be protected under HTTPS - except for the attachment downloads. Downloads can then be downloaded to the IE Temporay Internet files location before it can be opened by the external program.

Regards,
Keith

<Valve className="org.apache.catalina.authenticator.NonLoginAuthenticator"
disableProxyCaching="false" />

That'll disable proxy caching for all contexts, which is useful if you run JIRA and Confluence on the same machine.

After trying all of the solutions described, the one mentioned by Keith here (above):
http://jira.atlassian.com/browse/JRA-8179#action_55596

was the only one that actually worked.

I do have one comment though, could you guys put this security-constraint example in the default web.xml and comment it out with a good description?

I think that would save a lot of people some time..

http://support.microsoft.com/default.aspx?scid=kb;en-us;812935

We investigated this further and got a reply from Microsoft, confirming that the bug has been fixed in IE6 SP1 (sic), however, it needs a registry entry to work correctly.

This is the registry entry that a MS-Support-Guy sent to us:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Create a DWORD entry named BypassSSLNoCacheCheck, set this to "1"

There is also another setting for HTTP without SSL, but I doubt anybody might be able to make use of this: BypassHTTPNoCacheCheck

The short version of the problem is, that IE does not save/cache SSL-content on disk, not even if you ask it to do so via "Save Link as" command. The registry patch enables the bugfix. I've not tried IE7 with regards to this problem.

Using the all-except-attachments security constraint is a workaround, but that leaves attachments unencrypted.