Accessing a secure URL from a non-secure page with XMLHTTP fails with "Permission denied" error (304420)

SYMPTOMS

When you attempt to access a secure URL by using the XMLHTTP request object from a script on a non-secure Web page, you may receive one of the following error messages:

With Msxml2.XMLHTTP:

Permission Denied

With Microsoft.XMLHTTP:

Access is Denied

This problem only occurs if a non-secure page attempts to access a secure page. Accessing a secure page from another secure page does not generate an error.

MORE INFORMATION

Steps to Reproduce Behavior

In Microsoft Internet Information Services (IIS), create two Web sites named SiteA and SiteB.Under SiteA, save the following code as Client.asp:

<%@ Language=JavaScript %>
<%
	try
	{
                var Req = Server.CreateObject("Msxml2.DOMDocument.3.0");
                Req.async = false;
                Req.load("http://localhost/book.xml");
		
		Response.Write("<BR>responseText = " + Req.xml);
	}
	catch( e )
	{	
		Response.Write( "Exception!!<BR>");
		Response.Write(e.number + "<BR>");
		Response.Write(e.description + "<BR>");
	}	
%>

Under SiteB, save the following code as Client.htm:

<HTML>
<SCRIPT>

function onLoad()
{
	var Req = new ActiveXObject("Msxml2.XMLHTTP.3.0");
	var newURL  = "http://SiteA/client.asp";
	Req.open("GET", newURL, false);
	Req.send();

	alert(Req.status);
	alert(Req.responseText);
}
	
</SCRIPT>

<BODY onload="onLoad()">
</BODY>
</HTML>

Run the http://localhost/Client.htm file from either of the Web sites. The XML data is displayed. Install Secure Sockets Layer (SSL) on one of the sites, then modify the non-SSL Client.htm page so that it makes a request to Client.asp.Run the non-SSL Client.htm page. You receive the "Permission Denied" error. The Client.htm page on the SSL site does not produce this error.

Accessing a secure URL from a non-secure page with XMLHTTP fails with "Permission denied" error (304420)

SYMPTOMS

STATUS

MORE INFORMATION

Steps to Reproduce Behavior

REFERENCES