ScriptResource.axd Access is denied. Cross-Domain iFrame

Question

We have a web page containing an iframe containing a page sharing an authentification cookie with it's parent page. For example the iframe page is on the domain foo.domain.com and the page containing the iframe is on foo2.domain.com. Both share a cookie from domain.com. Authentification works great, but the problem is with ASP.NET in IE7, we always get a javascript error:

Access is denied.

ScriptResource.axd

We are using ASP.NET 3.5, we use Ajax Control Toolkit also (latest version 3.0.30930.0). The problem doesn't occur for IE8. No problem in Firefox and Chrome also.

Anyone encountered this problem before?

Answer 1

If there's a DNS redirection IE7 can have issues, e.g. if http://site.domain.com is really http://www.domain.com/site, the transparent DNS redirect has issues in IE7, but not the other browsers you mention. IE7 treats this as a cross-domain script and blocks...you just get Access Denied.

Is this the case, or something similar with redirects or different domains? If you can test the main page as just domain.com/ do you get the error? IE7 treats a child differently than a sibling.

Answer 2

In JavaScript you might need to change the document domain. It's possible IE7 is looking at the domains all the way to the server level: foo.domain.com != foo2.domain.com. IE8, et al, are likely taking the document domain at face value of *.domain.com.

Here's a quick related blog article on it: http://jszen.blogspot.com/2005/03/cross-domain-security-woes.html.

To copy the code though, adding the following to both pages should get it rolling again.

<script type="text/javascript">
  document.domain="example.com";
</script>

Answer 3

Try having a look at this