What does this javascript error mean? Permission denied to call method to Location.toString

Question

This error just started popping up all over our site.

Permission denied to call method to Location.toString

I'm seeing google posts that suggest that this is related to flash and our crossdomain.xml. What caused this to occur and how do you fix?

Answer 1

Are you using javascript to communicate between frames/iframes which point to different domains? This is not permitted by the JS "same origin/domain" security policy. Ie, if you have

<iframe name="foo" src="foo.com/script.js"> <iframe name="bar" src="bar.com/script.js">

And the script on bar.com tries to access window["foo"].Location.toString, you will get this (or similar) exceptions. Please also note that the same origin policy can also kick in if you have content from different subdomains. Here you can find a short and to the point explanation of it with examples.

Answer 2

You may have come across this posting, but it appears that a flash security update changed the behaviour of the crossdomain.xml, requiring you to specify a security policy to allow arbitrary headers to be sent from a remote domain. The Adobe knowledge base article (also referenced in the original post) is here.

Answer 3

This post suggests that there is one line that needs to be added to the crossdomain.xml file.

<allow-http-request-headers-from domain="*" headers="*"/>

Answer 4

This likely causeed by a change made in the Flash Player version released in early April, I'm not too sure about the specifics, but I assume there were security concerns with this functionality.

What you need to do is indeed add that to your crossdomain.xml (which should be in your servers webroot)

You can read more here: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html

A typical example of a crossdomain.xml is twitters, more info about how the file works can be found here.