How to Render XML from IE in a HTTPS Page? - asp.net

Question

I have some advanced users who need to see the raw XML of a transaction. I thought I could just have a link on the source page (with target="_blank") to a new page that would just output the XML using Response.Write, having set the Content-Disposition header to inline, and Response.ContentType to "text/xml".
That works nicely with FireFox and Chrome, but in IE10, I get the security warning about "Do you want to view only the webpage content that was delivered securely?"
Research shows that this message is displayed when the page contains "mixed content". That is, when some of the content is in "https", and some is in "http". That is not the case in my scenario, as the entire content is just the XML document, which doesn't even contain a reference to "http" in it.
I found several articles about this, and they suggest changing the page to use only https, or changing the IE security settings to "Enable" mixed content without prompting:
http://blog.httpwatch.com/2009/04/23/fixing-the-ie-8-warning-do-you-want-to-view-only-the-webpage-content-that-was-delivered-securely/
http://blogs.msdn.com/b/ieinternals/archive/2009/06/22/https-mixed-content-in-ie8.aspx
http://blog.httpwatch.com/2009/09/17/even-more-problems-with-the-ie-8-mixed-content-warning/
But, again, I have no "http" content on the "page"!
How can I display "raw" XML content in IE without this prompt?

Answer 1

I did this for an internal debugging app i made. It works in IE without any issues/popups. BUT, it's not really "raw XML", but more like xml -> html displayed in a div (still looks like XML though) as plain text. I made it using webapi, and also used angularjs, but you can change the angular to straight jquery.
Not sure if you're only after a straight up raw XML answer, but if you just want to display XML in text form, this should help you or at least give you some inspiration lol:
api action: returns xml through ajax. The webresponse().response = string that contains xml.
public HttpResponseMessage GetResponse(RequestDTO requestDTO)
{
return new HttpResponseMessage()
{
Content = WebResponse(requestDTO).Response
};
}
angular part:
$http.post('api/getresponse', requestData)
.success(function (data) {
$scope.response.xml = data;
});
html part:
<h3>XML Response</h3>
<pre highlight="response.xml" class="xml response"></pre>
Edit
To answer your questions:
"highlight" is a directive, and i think i originally made it because i was going to try and add code highlighting, but never did. But all it does is this:
angular.element(elem).text(value);
equivalent to the $(jquery).text(value); function.
As for the xml/response class, all it does is XDocument.Parse(xml), and return as new StringContent();
edited snippet from my code:
protected ResponseDTO WebResponse(RequestDTO requestDTO)
{
//....
var response = myRequest.GetXmlResponse(webResponse);
return new ResponseDTO()
{
Headers = new StringContent("....");
Response = new StringContent(response.ToString())
};
}
public XDocument GetXmlResponse(HttpWebResponse webResponse)
{
return XDocument.Parse(xmlResponse(webResponse, Encoding.UTF8));
}
the ajax is returned as Content-Type: text/plain; charset=utf-8