Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Accessing a secure URL from a non-secure page with XMLHTTP fails with "Permission denied" error

Accessing a secure URL from a non-secure page with XMLHTTP fails with "Permission denied" error

Symptoms

When you attempt to access a secure URL by using the XMLHTTP request object from a script on a non-secure Web page, you may receive one of the following error messages:


With Msxml2.XMLHTTP:
Permission Denied
With Microsoft.XMLHTTP:
Access is Denied
This problem only occurs if a non-secure page attempts to access a secure page. Accessing a secure page from another secure page does not generate an error.

↑ Back to the top

Status

This behavior is by design.

↑ Back to the top

More Information

Steps to Reproduce Behavior

In Microsoft Internet Information Services (IIS), create two Web sites named SiteA and SiteB.Under SiteA, save the following code as Client.asp:
<%@ Language=JavaScript %>
<%
try
{
                var Req = Server.CreateObject("Msxml2.DOMDocument.3.0");
                Req.async = false;
                Req.load("http://localhost/book.xml");

Response.Write("<BR>responseText = " + Req.xml);
}
catch( e )
{
Response.Write( "Exception!!<BR>");
Response.Write(e.number + "<BR>");
Response.Write(e.description + "<BR>");
}
%>
Under SiteB, save the following code as Client.htm:
<HTML>
<SCRIPT>

function onLoad()
{
var Req = new ActiveXObject("Msxml2.XMLHTTP.3.0");
var newURL  = "http://SiteA/client.asp";
Req.open("GET", newURL, false);
Req.send();

alert(Req.status);
alert(Req.responseText);
}

</SCRIPT>

<BODY onload="onLoad()">
</BODY>
</HTML>
Run the http://localhost/Client.htm file from either of the Web sites. The XML data is displayed. Install Secure Sockets Layer (SSL) on one of the sites, then modify the non-SSL Client.htm page so that it makes a request to Client.asp.Run the non-SSL Client.htm page. You receive the "Permission Denied" error. The Client.htm page on the SSL site does not produce this error.

↑ Back to the top

References

302080 BUG: "Access is denied" error message when making HTTPS requests with ServerXMLHTTP

↑ Back to the top

Keywords: kbdsupport, kbfix, kbmsxmlnosweep, kbprb, kb

↑ Back to the top

Article Info
Article ID : 304420
Revision : 3
Created on : 4/17/2018
Published on : 4/18/2018
Exists online : False
Views : 246