BUG: "500 Internal Server Error" Error Message When a User Closes a Browser Window That Contains a SecurID Logon Page

A user tries to visit a Web site that is published on a server computer that is running Microsoft Internet Security and Acceleration Server (ISA Server), and the Web publishing rules for the site are set to require SecurID authentication. When the browser makes the first request to the server, ISA Server displays the SecurID logon page in the browser window.

If the user closes this browser window without logging on, a new browser window opens. The user receives the following error message in the new browser window:Note If the user does not close the browser window that contains the SecurID logon page, and the user tries to visit a Web site that is located on a different server by typing a different URL in the address bar and pressing ENTER, the user receives the "500 Internal Server Error" error message in the existing browser window.

This behavior occurs only if both of the following are true:

• The computer that is running ISA Server has Feature Pack 1 installed.
• SecurID authentication is enabled in the Web publishing rule that is processed when the browser connects to the server.

This behavior does not occur if one of the following is true:

• The user types valid credentials in the SecurID logon page and then submits the page, and ISA Server successfully authenticates the user's credentials before the user closes the browser window.
• The user clicks Cancel on the SecurID logon page.

This behavior occurs because a problem exists in the SecurID authentication filter that is installed with ISA Server 2000 Feature Pack 1.

To avoid this behavior, follow these steps:

1. In a text editor such as Notepad, open the Useridandpasscode.htm file. This file is located in the Path of the ISA Server Install Folder\Sdisatemplates folder.
2. In line 6 of the file, change the need_cancel variable from false to true. For example, change

   var need_cancel = true

   to

   var need_cancel = false

3. Save and then close the file.

This change stops the browser from sending a new request to the server when the user closes the browser window or tries to visit a different site before authentication has completed.

The Useridandpasscode.htm file is installed with the SecurID authentication filter that is included with Feature Pack 1. ISA Server uses this file to generate the SecurID logon page that appears the first time that a user's browser connects to the server.

The SecurID logon page appears because SecurID authentication is enabled in the Web publishing rule that is processed when the browser connects to the server.