XMLHTTPRequest security model

[maui]

Hi all,

Through local testing I think I've determined a different between the
ie 6 (winxpsp2) and Firefox security models for XMLHTTPRequest objects
but would like to make sure I didn't conclude improperly.

Scenario: An HTML page in domain A references a Javascript file, via a
script tag, from domain B. That script creates a XMLHTTPRequest object
and tries to download some content from domain B.

In Firefox this works as the script is downloading from the domain
which was the source of the script.

In ie, this does not work and fails with a Permission Denied error.
However, the ie code does appear to work if the scipt downloads an
object from domain A.

For anyone who uses XMLHTTPRequest in a multi-domain setting, ss this
consistent with your experience?

Thanks,

Mark

 

[Jim Ley]

Scenario: An HTML page in domain A references a Javascript file, via a
script tag, from domain B. That script creates a XMLHTTPRequest object
and tries to download some content from domain B.

In Firefox this works as the script is downloading from the domain
which was the source of the script.

Er, this is a security concern and should not be happening. The
security context should be the URL of the page, not the URL of the
script.

I would recommend you raise this as an error in Mozilla.

Jim.