IE Pitfalls: Document “contype” Requests

This article describes slightly bizarre behavior which has been in Internet Explorer since version 4. You’ll encounter the issue if you use plugins or SVG images, e.g.

<object type="image/svg+xml" data="image.svg"></object>

When parsing this code, IE will make two GET requests:

1. The first is a request for the content-type (image/svg+xml) so the browser can invoke the handler application inside the browser window. This request is identified with a “contype” user agent string.
2. The second is a request for the document itself (which must also return the correct content-type).

(If you still worry about IE 4.x and 5.0.x, they make an additional initial request to get the content-type and perform a registry look-up to determine which application is required.)

No other browsers implement this process but it occurs in every version of Internet Explorer including IE9.

Unfortunately, it can lead to problems…

Large documents
If you are returning a large document, such as a PDF, the initial content-type request will timeout if it takes longer than 10 seconds. Static files probably aren’t an issue since your server may automatically recognize the “contype” request and respond accordingly. However, if you’re generating a document, it increases the possibility of a timeout. At best, IE is doubling your server load and skewing your statistics.

User agent checking
This is the problem I encountered. Web applications often check the user agent string for security purposes, i.e. if the user agent changes between subsequent requests, someone could be attempting to hijack the session — it’s invalidated and the user is logged out.

If you’re generating an SVG in a typical MVC application, IE makes the following requests for a resource containing that image:

1. The HTML page. The server is passed the standard MSIE user agent string (the session is valid).
2. The SVG content-type. The server is passed a user agent of “contype” which invalidates the session.
3. The SVG document. The server is passed the standard MSIE user agent string but nothing is returned because the session is no longer available.

It’s a difficult issue to debug since an IE user will log out every time they encounter a page with an SVG image.

The contype Solution

The best way to prevent issues is to detect the “contype” user agent, return the appropriate content-type and cancel further rendering. For example, in PHP:

if($_SERVER['HTTP_USER_AGENT'] == 'contype') {
	header('Content-Type: image/svg+xml');
	die();
}

Ugghh. No other vendor finds it necessary to make initial content-type requests, so let’s hope Microsoft rip this “feature” from IE10.

For more information, refer to PRB: Three GET Requests Are Sent When You Retrieve Plug-in Served Content.