trusted site required with activex

Question

Our web application has an activex dll that runs in IE. It is given a strong name and a custom permission set based on that strong name.

The assembly is decorated like this:

[assembly: AllowPartiallyTrustedCallers] 

and the class of the activex control needs this to run in the browser:

[PrintingPermission(SecurityAction.Assert, Unrestricted = true)]

When I add our custom code group under the Trusted_Zone and add the site to trusted sites, everything works fine. But when I add the code group under the Internet_Zone the activex control and remove the domain from trusted sites the activex control won't run.

In IE8, the security zones are all set to their default settings. Also when I change the security settings for "ActiveX controls and plug-ins" in the internet zone to the same as they are in the Trusted Site Zone, the control doesn't work. Is there something else I need to do, either through caspol or an IE setting to allow this to run in the internet zone?

Answer 1

Is your ActiveX control signed? I believe this is required in order run on a non-trusted site.

http://msdn.microsoft.com/en-us/library/aa231196%28VS.60%29.aspx

Answer 2

Have you added the safe for scripting and safe for initialization categories on the COM registration (or implemented IObjectSafety). If you dont then IE will not trust you control at all and refuse to create it. See something like this for info on putting the correct keys in the registry.

Or are you using it in IE directly? As in not registering it but passing the dll path in the classid attribute? If so then life is more difficult. IE8 no longer loads dotnet controls in the Internet zone and there is no user interface to enable it (from what I remember, although have a look in the security editor). You can change it in the registry by setting the URL Action for URLACTION_DOTNET_USERCONTROLS for the Internet zone to enabled.