HTTPRequest and Same Origin Policy

[Randy Webb]

Is the HTTPRequest Object in IE limited to the Same Origin Policy when
run from a webserver?
<URL: http://www.hikksworld.com/HTTPRequestIE.html />
When run in IE, throws a "Permission Denied" error. When I run that page
locally, it works without errors. Which leads me to believe that its
Same Origin Policy coming in, since I can give it www.hikksworld.com
instead of www.google.com and it works from the server.
Or, is it just something that I am missing that would allow it to "work"
in IE from the server?

The Mozilla version I have, works locally or from the server.
<URL: http://www.hikksworld.com/HTTPRequestMoz.html />
It doesn't matter (once I give permission) in Mozilla what file I want
to read, it reads it.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javascript FAQ - http://jibbering.com/faq/

[Martin Honnen]

Randy Webb wrote:

Is the HTTPRequest Object in IE limited to the Same Origin Policy when
run from a webserver?
<URL: http://www.hikksworld.com/HTTPRequestIE.html />
When run in IE, throws a "Permission Denied" error. When I run that page
locally, it works without errors. Which leads me to believe that its
Same Origin Policy coming in, since I can give it www.hikksworld.com
instead of www.google.com and it works from the server.
Or, is it just something that I am missing that would allow it to "work"
in IE from the server?

The Mozilla version I have, works locally or from the server.
<URL: http://www.hikksworld.com/HTTPRequestMoz.html />
It doesn't matter (once I give permission) in Mozilla what file I want
to read, it reads it.

Your Mozilla version only throws errors for me with Netscape 7.1, and
looking at the code it appears you expect people to have codebased
principals enabled as otherwise the
netscape.security.PrivilegeManager.enablePrivilege call will simply fail
in a page loaded via http.

So both Mozilla and IE have the same origin policy for XMLHttpRequest
respectively Msxml2.XMLHTTP, with Netscape you need to successfully
request the privilege to be able to access files from other domains, and
IE can be configured to allow that in the security settings for the
internet zone, there is an option to allow access to data sources across
domains that can be enabled in general or set to prompt the user to
allow the access.
--

Martin Honnen
http://JavaScript.FAQTs.com/

[Randy Webb]

Martin Honnen wrote:

Randy Webb wrote:

Is the HTTPRequest Object in IE limited to the Same Origin Policy when
run from a webserver?
<URL: http://www.hikksworld.com/HTTPRequestIE.html />
When run in IE, throws a "Permission Denied" error. When I run that
page locally, it works without errors. Which leads me to believe that
its Same Origin Policy coming in, since I can give it
www.hikksworld.com instead of www.google.com and it works from the
server.
Or, is it just something that I am missing that would allow it to
"work" in IE from the server?

The Mozilla version I have, works locally or from the server.
<URL: http://www.hikksworld.com/HTTPRequestMoz.html />
It doesn't matter (once I give permission) in Mozilla what file I want
to read, it reads it.

Your Mozilla version only throws errors for me with Netscape 7.1, and
looking at the code it appears you expect people to have codebased
principals enabled as otherwise the
netscape.security.PrivilegeManager.enablePrivilege call will simply fail
in a page loaded via http.

So both Mozilla and IE have the same origin policy for XMLHttpRequest
respectively Msxml2.XMLHTTP, with Netscape you need to successfully
request the privilege to be able to access files from other domains, and
IE can be configured to allow that in the security settings for the
internet zone, there is an option to allow access to data sources across
domains that can be enabled in general or set to prompt the user to
allow the access.

Many thanks Martin. When I first wrote that page, it was mostly for
personal use and a learning experience. Now, its on to learn how to do
that in PHP :)

--
Randy
Chance Favors The Prepared Mind
comp.lang.javascript FAQ - http://jibbering.com/faq/