When HTTPS Inspection is enabled in a Microsoft Forefront Threat Management Gateway (TMG) 2010 environment, some outgoing POST requests may be handled incorrectly without a POST body being sent to the external web server.
For example, consider the following scenario:
In this scenario, you expect the client to resend the request over a new connection. However, this does not occur because an Internet Explorer issue is exposed. The Internet Explorer issue is described in the following article in the Microsoft Knowledge Base:
For example, consider the following scenario:
- The client makes an outgoing SSL request to the web server to retrieve a webpage.
- TMG inspects the traffic and then makes an onward connection to the web server.
- The request is served to the client, and both the "client to TMG" and "TMG to web server" TCP connections are maintained.
- A short time later, after the web server connection idle time is reached, the web server times out and closes the "TMG to web server" connection.
- The closed "TMG to web server" connection is not detected by the TMG server because the connection is currently not being used.
- The client makes a POST request to the web server by using the existing "client to TMG" connection.
- TMG receives the request, checks the "TMG to web server" connection, and finds that the connection was closed by the web server.
- TMG signals a connection closure to the client.
- 1359 An internal error occurred might be logged in the Web Proxy log.
In this scenario, you expect the client to resend the request over a new connection. However, this does not occur because an Internet Explorer issue is exposed. The Internet Explorer issue is described in the following article in the Microsoft Knowledge Base:
895954 When you use Microsoft Internet Explorer or another program to perform a re-POST operation, only the header data is posted
Note In addition to the POST error, this scenario/issue TK may also cause random "Page Cannot Be Displayed" error messages for GET requests if multiple connections are timed out. This occurs because Internet Explorer retries GET requests only three times. If the three tries are all made on connections that are timed out externally by the web server, request failures may also occur.