Looking for doc on why IE "yellow bar" shows when opening a HTML file that contains JavaScript

Question

I have a site, from which you can download an HTML file. This HTML file contains a form with hidden fields, which is right away posted back to the site using JavaScript. This is a way of allowing users to download to their own machine data that they edit on the site.

On some machines, you get an IE "yellow bar" when trying to open the file you saved. The "yellow bar" in IE is warning that the HTML is trying to run an Active X (which it is not, there is only JavaScript doing a submit() on a form). However if you receive the exact same HTML file by email, save it, and open it, you don't have this problem. (It looks like IE is putting some more constraint on what can be done in a HTML file you saved from web site.)

My question is: where can I find documentation on this IE security mechanism, and possibly how can I get around it?

Alex

Answer 1

I don't 100% follow what your JavaScript is submitting to, but if you're submitting back to the original site from the downloaded copy you'll have a problem using JavaScript as all browsers treat cross-domain JavaScript as a security violation.

JavaScript isn't allowed to read or write to any site not on the current domain

Answer 2

The yellow bar is because your page is executing in the Local Machine security zone in IE. On different machines, the Local Machine security zone might be configured in different ways, so you can see the yellow bar on some machines and not see it on other machines.

To learn more about the IE's URL Security Zones, you can start reading here: http://msdn.microsoft.com/en-us/library/ms537183.aspx

Answer 3

I am not usre about any specific documnet, but if you open the properties for the file in windows explorer on the general tab is the file blocked? if so click unblock and try again and see if you gte the same issue. This is typical security for files downloaded fom the internet.

Other than that i am afraid i dont know what else to suggest.

Answer 4

As Franci had said it is becaue you are in the local machine security context and this allows scripts to create objects and execute code that could do harm to your PC. For example you can create a File System Object and perform tasks that an untrusted page shouldn't perform generally because it could be malicious in nature.

Answer 5

Have you tried changing the file name from yourname.html to yourname.hta to see if the security problem goes away?

More on HTML Applications (.HTA files): http://msdn.microsoft.com/en-us/library/ms536496%28VS.85%29.aspx

Answer 6

Look here for details on the MOTW - Mark Of The Web

If you add this to your locally served pages, IE will not show the yellow bar.

http://msdn.microsoft.com/en-us/library/ms537628(VS.85).aspx