Javascript & Windows XP SP2 Security

[Nathan Sokalski]

As most Javascript coders probably know by now, IE on Windows XP SP2 likes
to prevent our code from running right away (the user is asked to give
permission the first time). Although I can see the danger in allowing all
scripts to run, the fact that IE makes it sound like we are going to install
some huge, horrible application when we are simply adding rollovers or
client-side validation or some other simple little thing really frustrates
me. Specifically what stuff does IE block? Does it check for certain methods
in the script? Does it block everything until you say it's OK? What can
places do to allow their scripts to be run without the need to be validated
by the user? I have heard about "Signed Scripts", but I feel that it would
be hard to modify and develop when a script had to be "Signed" every time.
Any comments?

 

[wl]

As most Javascript coders probably know by now, IE on Windows XP SP2 likes
to prevent our code from running right away (the user is asked to give
permission the first time). Although I can see the danger in allowing all
scripts to run, the fact that IE makes it sound like we are going to
install some huge, horrible application when we are simply adding
rollovers or client-side validation or some other simple little thing
really frustrates me. Specifically what stuff does IE block? Does it check
for certain methods in the script? Does it block everything until you say
it's OK? What can places do to allow their scripts to be run without the
need to be validated by the user? I have heard about "Signed Scripts", but
I feel that it would be hard to modify and develop when a script had to be
"Signed" every time. Any comments?

My experience is that Internet Explorer is only asking to run the script if
the page is run locally (from the file system).
It seems no confirmation is needed when the page is hosted on the internet ?

Wim

 

[kaeli]

As most Javascript coders probably know by now, IE on Windows XP SP2 likes
to prevent our code from running right away (the user is asked to give
permission the first time).

AFAIK, only on localhost.
So what's the problem?
You coding for a CD for Windows? If so, use HTA instead.
There's a reason for the new security settings, and as irritating as it is
for testing stuff locally, it is actually a pretty good idea, considering all
the security holes in MSIE. There is a workaround for turning it off. Google
it. It's on MSDN somewhere.

--