Google not loading first time in IE11 via a web proxy on Windows 8.1? Turn off SPDY support.

Update 14/03/14: According to Microsoft, this problem is fixed in the March 2014 Cumulative security update for Internet Explorer. However, I was able to immediately reproduce the problem even after the update was installed, so the below still applies as far as I’m concerned.

As my former boss Bond once said, “If you’re going to live on the cutting edge, you’ve got to expect some blood”. One of the many joys of being an early adopter is finding stupid bugs before everyone else, and so as I began wide-scale testing of Windows 8.1 at my school, we found this one.

In a nutshell, pretty much every time we tried to load www.google.com in Internet Explorer 11, we got a “This page can’t be displayed” message, yet the site would inexplicably load fine just by clicking refresh. We saw the same with other Google sites such as Gmail and Google Drive – but most sites seemed immune. Both the desktop and Modern UI versions of IE were affected.

Like most schools, our web access goes via an HTTP proxy so that content not suitable for the 5 year-old cherubs can be filtered out. We use Smoothwall, which is one of the better filtering products out there, but so many applications are not designed with proxy support in mind that it does occasionally cause problems. It’s very rare for any mainstream browser to have a problem with proxies, but when I bypassed it, the problem immediately went away. What was more curious was that we were already running Internet Explorer 11 on our Windows 7 workstations too, and they didn’t have any problems.

After a lot of trial and error, swearing, and a largely unsuccessful few hours scouring forums, I hit upon an Experts Exchange thread where someone having almost the exact same issue reported that they could eliminate it by turning off TLS support. That’s not especially great as a workaround, as it reduces security and will cause websites that insist on TLS for secure connections to become inaccessible. However, after reading up on new features added in Internet Explorer 11, something stuck out: SPDY support is new for IE11, but only in the Windows 8.1 version.

Lo and behold, turning off SPDY support in IE11 immediately resolved the problem.

You can read more about SPDY here, but the salient points are that it relies on TLS to work (which is why disabling TLS eliminated the symptoms), only works on secure connections, and has to be supported on the server side (which is why only some websites were affected). Google is among the 1-2% of sites that do use support SPDY, and is far and away the most popular one with our users.

Both Google Chrome and Firefox have had SPDY support for a while, and neither exhibit the problem on the same machines using the same proxy, so this is something specific to IE11.

You too?

I don’t know if at affects all proxies, but the thread on Experts Exchange identified it as happening with Websense, and once I knew what to look for I’ve also found the same problem reported with Microsoft’s Threat Management Gateway, so it’s not definitely not limited to Smoothwall. If you have a different proxy and are experiencing this problem, please leave a comment with the name of the proxy software you’re using. I have also filed a bug report for this on the Microsoft Connect site and would appreciate it if you would click the link to indicate you can reproduce the problem: Microsoft Connect – Bug 813993.

Disabling SPDY

As well as disabling it in Internet options on the Advanced tab (see below), you can also disable it via Group Policy at either the Computer or User level by going to Windows Components\Internet Explorer\Internet Control Panel\Advanced Page and setting the Allow Internet Explorer to use the SPDY/3 network protocol policy to Disabled.

There should be no compatibility issues caused by disabling SPDY as it should never be required by any website. You’ll lose the intended performance gains, but until Microsoft can get it to work right via a proxy, you’re better off not annoying your users by making them hit refresh all the time.

“But I can’t load Google and I’m not using a proxy/IE11/Windows 8.1…”

Then you’ve got a different problem. There were other reported problems with loading Google on IE11, and there are plenty of other reasons you could be getting a “This page can’t be displayed” message. This issue only affects you if your web access is via a proxy and you are using Internet Explorer 11 on Windows 8.1. If you don’t meet all of those conditions, do not bother leaving me a comment about how disabling SPDY didn’t work for you. I will delete it. You’ve got a different problem.