Google not loading first time in IE11 via a web proxy on Windows 8.1? Turn off SPDY support.

Update 14/03/14: According to Microsoft, this problem is fixed in the March 2014 Cumulative security update for Internet Explorer. However, I was able to immediately reproduce the problem even after the update was installed, so the below still applies as far as I’m concerned.

As my former boss Bond once said, “If you’re going to live on the cutting edge, you’ve got to expect some blood”. One of the many joys of being an early adopter is finding stupid bugs before everyone else, and so as I began wide-scale testing of Windows 8.1 at my school, we found this one.

In a nutshell, pretty much every time we tried to load www.google.com in Internet Explorer 11, we got a “This page can’t be displayed” message, yet the site would inexplicably load fine just by clicking refresh. We saw the same with other Google sites such as Gmail and Google Drive – but most sites seemed immune. Both the desktop and Modern UI versions of IE were affected.

Like most schools, our web access goes via an HTTP proxy so that content not suitable for the 5 year-old cherubs can be filtered out. We use Smoothwall, which is one of the better filtering products out there, but so many applications are not designed with proxy support in mind that it does occasionally cause problems. It’s very rare for any mainstream browser to have a problem with proxies, but when I bypassed it, the problem immediately went away. What was more curious was that we were already running Internet Explorer 11 on our Windows 7 workstations too, and they didn’t have any problems.

After a lot of trial and error, swearing, and a largely unsuccessful few hours scouring forums, I hit upon an Experts Exchange thread where someone having almost the exact same issue reported that they could eliminate it by turning off TLS support. That’s not especially great as a workaround, as it reduces security and will cause websites that insist on TLS for secure connections to become inaccessible. However, after reading up on new features added in Internet Explorer 11, something stuck out: SPDY support is new for IE11, but only in the Windows 8.1 version.

Lo and behold, turning off SPDY support in IE11 immediately resolved the problem.

You can read more about SPDY here, but the salient points are that it relies on TLS to work (which is why disabling TLS eliminated the symptoms), only works on secure connections, and has to be supported on the server side (which is why only some websites were affected). Google is among the 1-2% of sites that do use support SPDY, and is far and away the most popular one with our users.

Both Google Chrome and Firefox have had SPDY support for a while, and neither exhibit the problem on the same machines using the same proxy, so this is something specific to IE11.

You too?

I don’t know if at affects all proxies, but the thread on Experts Exchange identified it as happening with Websense, and once I knew what to look for I’ve also found the same problem reported with Microsoft’s Threat Management Gateway, so it’s not definitely not limited to Smoothwall. If you have a different proxy and are experiencing this problem, please leave a comment with the name of the proxy software you’re using. I have also filed a bug report for this on the Microsoft Connect site and would appreciate it if you would click the link to indicate you can reproduce the problem: Microsoft Connect – Bug 813993.

Disabling SPDY

As well as disabling it in Internet options on the Advanced tab (see below), you can also disable it via Group Policy at either the Computer or User level by going to Windows Components\Internet Explorer\Internet Control Panel\Advanced Page and setting the Allow Internet Explorer to use the SPDY/3 network protocol policy to Disabled.

There should be no compatibility issues caused by disabling SPDY as it should never be required by any website. You’ll lose the intended performance gains, but until Microsoft can get it to work right via a proxy, you’re better off not annoying your users by making them hit refresh all the time.

Disable SPDY in IE11

“But I can’t load Google and I’m not using a proxy/IE11/Windows 8.1…”

Then you’ve got a different problem. There were other reported problems with loading Google on IE11, and there are plenty of other reasons you could be getting a “This page can’t be displayed” message. This issue only affects you if your web access is via a proxy and you are using Internet Explorer 11 on Windows 8.1. If you don’t meet all of those conditions, do not bother leaving me a comment about how disabling SPDY didn’t work for you. I will delete it. You’ve got a different problem.

Tags: , ,

About The Angry Technician

The Angry Technician is an experienced IT professional in the UK education sector. Normally found in various states of annoyance on his blog. All views are those of his imaginary pet dog, Howard.

25 responses to “Google not loading first time in IE11 via a web proxy on Windows 8.1? Turn off SPDY support.”

  1. prince jasbo says :

    thanks for this, just gone ie11 on 7 and getting ready to test ie11 on 8.1 – this will save some shouting in the office.

  2. Angry Squirrel says :

    I had been wondering about this since the upgrade to 8.1. I thought it was somehow tied to checking of CRLs as I would usually (not always) see them being loaded at the same time. I assumed that having refreshed the list it would accept the connection on reload. Big thanks for finding this!

  3. ScottishTech says :

    Nice one, Sir.

    I’ve not ventured into the big brave world of IE11 or Win8.1 yet but both are on the “to do” list (once the other 6 impossible things before breakfast are done). IE11 because of the whole having to recreate IE GPOs as GPPs which requires 2012 or Win8 to create in the first place.

    I’ll bear this in mind, though. Much appreciated.

  4. John says :

    We have just started doing the same thing at our college, and found that it works if, rather than disabling SPDY, we disable use http 1.1 (but keep use http 1.1 through proxy enabled). We use a home made red hat server running squid proxy server and iptables for our firewall.
    Otherwise our Windows 8.1 trials are going well, apart from some issues with Adobe CC being in our WDS image!
    I don’t know what you do with desktop wallpaper, but Windows 8 likes to cache it so when we update our wallpaper across college, Windows 8 still uses the old one, but we have a nifty way of solving that if you’re interested!

    • The Angry Technician says :

      The only real customisation we have is the lock screen image and colours. We don’t do anything with desktop wallpaper, users can set their own (within limits of suitability). We also set default colours and style for the Start Screen and the account picture, but those can also be changed by the user.

  5. Jon says :

    Thanks for pointing out a problem I didnt know I had (and I am not sure I have) as I rarely use IE11 .

    I am running Win8.1 and use MS TMG as a proxy.

    I loaded IE and went to google as suggested and got a page cannot be displayed error. Refreshed and got to the site. Seems like this bug is affecting me.

    However, since then I havent experienced the bug.
    For you is this repeatable everytime you open the browser? Or is there a period of time before the problem reoccurs?

    Cheers
    Jon

    *Just tried it again before submitting and got the error again

  6. Bob says :

    Excellent – this resolved our issue, thanks. Couldn’t see where it was failing as the request wasn’t even reaching the proxy (Bluecoat).

  7. James Moore says :

    This way works for me
    On proxy settings uncheck “Use the same proxy server for all protocols”. clear address and port of the Secure type
    leave SPDY enabled
    You get the benefit of keeping SPDY and your proxy server. For my situation there is no benefit to sending ssl via the proxy anyway..
    I’d like to enable this via GP but for some reason proxy settings never applied for me that way.

    • The Angry Technician says :

      SPDY only works on HTTPS sites, which is why this works, but the reason most schools use a proxy in the first place is to apply filtering of some kind. If you bypass the proxy for HTTPS then your users will have unfettered access to any site that supports a secure connection, which is an ever-increasing number, and depending on your age group may be extremely unwise.

  8. Bart Sondermeijer says :

    Same issue here with an pfsense installation + squid 3.0 package and HAVP proxy filter. Can reproduce this by disabling/enabling SPDY 3 in IE 11.
    Seems to be an bug in IE 11 ? Other browsers like Chrome and Firefox run fine on Windows 8.1 with upstream pfsense + squid 3.0 package and HAVP.

  9. jackrt says :

    cheers for this, thrown myself in at the deep end by installing 8.1 on my machine (i network manage a school with ~700 computers). you’ve just sorted nearly three months of head banging! :)

  10. Stuart says :

    This issue has now been resolved in the latest Cumulative Security Update for Microsoft Internet Explorer 11. You can get the update via Microsoft Update and then turn back on SPDY support in the browser.
    “MS14-012: Cumulative security update for Internet Explorer: March 11, 2014″ Includes fix for “This page can’t be displayed” error when you browse a Google webpage in Internet Explorer 11

  11. brendan62269 says :

    Great post! Thanks for sharing your find, it appears to have resolved my issue (we use Websense).
    I’ve been suspicious of this issue since the beginning. I’ve been using Google since the ’90s and I was certain it was a ploy by either Google to move me to Chrome or Microsoft or move me to Bing, so I’ve resisted and held out for a fix.
    Looks like maybe Microsoft may be embracing technology in a way lets them poke a finger in someone else’s eye, or maybe it’s Google interpreting an RFC in a *special* way. Either case would be a surprise and I’d find it hard to believe they wouldn’t be aware of this issue and it’s effect in a typical enterprise setting (both Bing and Chrome suck :).
    Thanks again!

  12. RW says :

    Thanks so much, trialing it now but been looking for an answer for ages.
    Tried and problematic on ISA proxy & webmarshal too

  13. marek. says :

    Brilliant, thank You! Disabling SPDY solved my issue with not loading up web pages in IE11 on the first try.

  14. Lisa says :

    Ahhh!!! I plugged my symptoms in to a search engine for this in vein not really believing that I would come up with the solution…. but here it is! Thanks. I was experiencing the same problem behind a Barracuda proxy.

  15. Daniel McNicol says :

    thank you for this! been searching for a while now, recently updated the terminal servers to Server 2012 R2 and all users had this problem, we are behind a BLOXX proxy Server.

  16. Jan says :

    Awesome! I was experiencing this same behaviour with IE11 on Windows8.1 and Linux Squid Proxy! You saved my day with SPDY/3!!!

  17. NickyB says :

    We were getting this with Cisco Ironport proxies – disabling via GPO as you suggested worked so thanks very much!
    Related note: did you know that 8.1 opens up a security hole where users can access and change their proxy settings? Was a big deal for us so raised a call and got a sort-of workaround: http://social.technet.microsoft.com/Forums/windows/en-US/7d420c66-2e89-43d7-b136-baf5f69690f1/locking-down-ie-proxy-settings-under-pc-settingsnetworkproxy-on-windows-81?forum=w8itprosecurity

  18. Nigel Prebble says :

    Great write up this solved the problem for me. Many thanks.

  19. Mac says :

    Thank you!

  20. AddressTheProblemNotTheSymptom says :

    To the OP: Websense and Webroot etc have this issue for a different reason as well. Google.com will load a youtube.com plugin or URL in the background when loading the regular site the first time you visit it. The second time it redirects to https://www.google.com without any issue. After testing this with Websense and Webroot, it was clear that the youtube plugin/url/css or whatever was being blocked by the web security policy causing the page not to load. To fix this issue, we ultimately had to put a proxy bypass in for google which allowed the site to load without failing to load the youtube tie in. Just an FYI for those that try the SPDY resolution and are still seeing the same issue. It is a bugger!

  21. Dan says :

    Thanks! SPDY was actually slowing down the loading of sites on my 8.1 PC. It’s pretty bad when they have to sneak this on your machine.

    This has saved me much frustration!

Share your Anger

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 1,764 other followers