Django-HttpRedirect fails in Internet explorer

Question

I have a Facebook application using Django. In one of my views I use following piece of code to make user logged-in.

In IE, return HttpResponseRedirect line fails with error message "This content cannot be displayed in a frame...", although other browsers are working fine.

Do you have an idea, why IE fails for HttpResponseRedirect? (This is problem is produced on IE9 on Windows 7, server is using django-1.3)

def auto_login(request):
    username = request.GET['username']
    password = request.GET['password']
    user = authenticate(username=username, password=password)
    if user is not None:
            if user.is_active:
        login(request, user)
        theURL='http://apps.facebook.com/myapp/'
        return HttpResponseRedirect(theURL)
            else:
            return HttpResponse("disabled account")
    else:
        return HttpResponse("Invalid login")

Answer 1

This can be two things, both related to the browser security model.

Option 1 is the redirect to another domain. Clients may decide to follow the redirect, or to refuse. In particular a HTTP 307 redirect (which allows forwarding of POST data) is not always accepted by clients.

Option 2 is related to the redirect of a resource with HTTP method POST url to another resource with method GET.

If the HTTP method of the current view and the redirect are different (i.e. HTTP POST against the /login url vs. HTTP GET of the facebook/myapp), at least IE8 will refuse to redirect. I'm not sure of this has been changed in IE9.

There's a few things you could try.

• You could try another HTTP response code. Assuming there is no need to forward the HTTP parameters from the original request to the redirected request, a response code 303 would be better than a 307.
• If your situation involves a redirect of an HTTP POST resource to the external HTTP GET resource at facebook, another attempt is put an extra redirect in the middle: POST resource on yoursite.com --> redirect to GET resource on yoursite.com --> external redirect to facebook domain.
• The "extra redirect" option could fix one browser but break another (browsers have limits on redirects, which may vary per browser type and version). If you would get into this situation you may need to detect the user-agent and switch between IE and other browsers.

A few good links:

Django/IE8 Admin Interface Weirdness

http://en.wikipedia.org/wiki/List_of_HTTP_status_codes