So I lied, apparently my hackery wasn’t enough to appease IE even though Firefox happily worked going forward. Apparently in IE it determines, “Oh, I’ve been authenticated on this URL before…so lets send broken authentication information instead of an upload”, and then no matter what you respond back to the request with it just ignores it an on the Flash side acts like it sends the file (very quickly), but never actually comes across.
So now we must expand the previous hackery to not only ignore authentication on uploads, but we have to send to a different “url” in order to keep Flash from thinking it needs to authenticate. I originally tried doing a variation on the directory structure (ie. /authenticated and /unauthenticated), but it’s a tricksy URLRequest and decided that it was the same host so it really wanted to send broken authentication information.
My solution? Make Tomcat listen on another port by adding the following line to my server.xml:
<Connector connectionTimeout="20000" maxThreads="150" port="15000" protocol="HTTP/1.1" redirectPort="8443"/>
Then I told my upload to send to the exact same URL except on a different port. I still had to have my security hackery to keep it from requesting authentication, but that did the trick. Now both IE and Firefox can upload files in a JCIFS protected container and the client is none the wiser…unless of course a firewall is blocking that port for which they are trying to upload to….but such are the hacks we must work with when dealing with Flash.
On a side note I will say that Flex 3 has functionality built-in (apparently they got enough rocks through their windows from 2.01 to make them realize they needed to fix it) to tell it to handle authentication or not via a boolean flag. None of this would have been necessary if they would have had the fore-sight to implement that in the first place, but alas, mine is not to reason why…