Open new https browser window using javascript

Question

I have situation where in c# code I am adding an onclick client event handler. It should do:

  Button1.Attributes.Add("onclick", "javascript:window.open('https://"+Request.ServerVariables["HTTP_POST"]+"/reports/?type=1&id=2");

in the end the URL looks like:

https://servername/reports/?type=1&id=2

in the reports folder of my site I have a default aspx page that handles those parameters.

When I click the button with this event, a new window opens but it says there is no page at that address. When I use the link like this

https://servername/reports/default.aspx?type=1&id=2

The page opens but it's blank.

When I run this code as non secure with HTTP, everything works just like it should. The report opens.

Is there any difference using those two different URLs with default.aspx and without it, because in development it behaves the same way, but under HTTPS one page doesn't exist and another is blank?! Is HTTPS the reason for that??

Thanks!

Answer 1

• JavaScript does not interpolate variable names in string literals. You are literally using the server name Request.ServerVariables["HTTP_POST"], and since that's not a real server name (or even valid in a URL) it won't open.

• JavaScript is a client-side language, it does not have access to Request.ServerVariables. You would need to use templating to output variables from ASP into the client document, and if you're putting something in a JavaScript string literal you should in general be JSON-encoding, to stop ' and \ characters (and a few others) in the text breaking the string. If you're outputting to a JavaString string literal inside an HTML event handler attribute, you'd have to JSON-encode the string and then HTML-encode that afterwards. The layers of escaping involved in putting content into event handlers is annoying and error-prone. Avoid it, by not using event handler attributes.

• You probably meant HTTP_HOST, not POST.

• You don't need javascript: in an event handler; it doesn't do anything. You're thinking of javascript: pseudo-URLs in links, but you should never use those either. Put the real URL in a plain link, so that it still works with JavaScript disabled and doesn't break with options like middle-click, and then use JS to augment the link so it opens in a new window when clicked normally.

This is known as ‘progressive enhancement’:

<a class="newwindow" href="https://&lt;%= Server.HTMLEncode(Request.ServerVariables["HTTP_POST"]) %>/reports/?type=1&amp;id=2">

<!-- at end of document -->
<script type="text/javascript">
    for (var i= document.links.length; i-->0;)
        if (document.links[i].className==='newwindow')
            document.links[i].onclick= newWindowClick;

    function newWindowClick() {
        var w= window.open(this.href);
        return !w || w.closed;
        // stops link being followed in the current page (return false)
        // unless pop-up was blocked
    }
</script>

(In ASP.NET 4, you can use <%: instead of <%= to avoid the need to Server.HTMLEncode anything. There's probably not going to be any HTML-special characters in a host name, but it's a good practice to get used to HTML-encoding, because miss it anywhere more critical and you've got yourself an HTML-injection potentially leading to XSS security holes.)

However this is generally considered an old-fashioned way to template; the ASP.NET HTML controls would often be preferred. You should also consider simply using a target="_blank" attribute instead of all the JS complexity. (Whilst it is not valid in HTML 4 Strict, it is back in HTML5 and is a bit more maintainable.)

<asp:HyperLink id="thelink" Target="_blank" Text="some link text"/>

// VBS in Page_Load:
thelink.NavigateUrl= "https://" & Request.ServerVariables["HTTP_POST"] & "/reports/?type=1&id=2";

Finally, you should also definitely consider not having a pop-up at all. Many users consider it hostile (if I wanted it in a new window, I'd click ‘open in new window’). Plus in some browsers it'll open in a new tab instead of a new window anyway, which you probably don't want.

Answer 2

You may also want to add return=false to your script.

    String s= "window.open('" + Request.Url.AbsoluteUri.Replace("http", "https") + "');return false;";
    ButtonTest.Attributes.Add("onclick", s);

Answer 3

Solution found, and I have nothing to say except WOOW! It has nothing to do with ssl or IIS or paths, it's with permisions on windows temp folder, and crystal report couldn't save temporary file.

Hope this will help someone.