IE6 SP2 access denied error

[gigard]

I have an issue with Internet Explorer 6.0.2900.218, SP2, 128-bit cipher strength not rendering content in a frameset from an SSL enabled web server. This server happens to be my client’s server and is where the product will reside. I have not been able to reproduce this issue on two other servers running SSL so I can’t imagine what this particular server’s issues are. Finally, the problem is not experienced when using earlier versions of Internet Explorer, or Opera or Firefox.

The frameset is created in index.html. The frameset is designed as follows:

<FRAMESET cols="197,*" frameborder="NO" border="0" onload="populate();" onunload="exitCourse('incomplete');">
<FRAME name="nav" title="navigational links frame" src="leftNav2.html" scrolling="no" marginwidth="0" marginheight="0">
<FRAMESET rows="52px,*" frameborder="NO" border="0" >
<FRAME name="logo" title="top frame" src="topFrame.html" scrolling="no" marginwidth="0" marginheight="0">
<FRAME name="content" title="contents frame" src="blank.html" scrolling="no" marginwidth="0" marginheight="0">
</FRAMESET>
</FRAMESET>

Lessons.js contains multiple functions that handle navigation, look-feel and pop-up window generation. It is referenced as follows in the header section of index.html

<script language="JavaScript" src="scripts/lesson.js"></SCRIPT>

The problem is that no files can be placed in the “content” frame using JavaScript when running on one server. The server is Apache/2.0.48 (Unix) mod_jk2/2.0.2 and is using SSL. Index.html correctly populates the “nav” frame and the “logo” frame. The “content” frame initially is populated by blank.html which is as designed. Some content in the “nav” and “Logo” frames are dynamically generated using JavaScript. This is correctly displayed, so the JavaScript is being read correctly.

Using the debugger in IE, I have identified what lines of code are at the core of the problem.

Index.html’s body tag calls the function populate() using the onLoad event. The function populate() resides in lesson.js.

function populate(){
bottom=URLprefix + pageArray[0];
parent.content.location.href = bottom;
loadPage();
}

var URLprefix = “

https://*********/scorm-content/***/****/modA/”;

pageArray = new Array (
"intro.htm",
"1000.htm",
""
)
Originally, I did not have the var URLPrefix but I put that in just to see if having a complete URL would correct the problem – it didn’t.

The line in populate() causing the problem is

parent.content.location.href = bottom;.

I get an “Access Denied” error here.

I get other “Access Denied” errors in other functions at this line

var url = parent.content.document.URL; .

What is the issue with trying to access the document.URL and document.href? Can web servers shut this access off? What is the workaround?

When I set IE6 SP2 Advanced Options to “Allow Active Content to run in files on My Computer”, the problem goes away. This is not an acceptable solution. Besides, the content is delivered via the internet.

 

[jemminger]

are all the files for all frames being served from the same protocol and domain? e.g.

all in

https://foo.com/

not some in

http://foo.com/,

some in

https://foo.com/

or some in

https://foo.com/

and some in

https://bar.com/

-jeff

http://www.jeffemminger.com

try { succeed(); } catch(E) { tryAgain(); } finally { rtfm(); }
i like your sleeves...they're real big

 

[gigard]

Yes they are. They are all under

https://thesame.domain

 

[gigard]

A clarification on my last comment. My client now tells me they are load balancing this content. Could that make it cross-domain even though all the code resides on one server?

 

[jemminger]

it should be ok if the load balancing is behind the scenes, and all URLs are the same

it could present a problem if the URLs end up different, like

https://www1.domain/

and

https://www2.domain/

etc


-jeff

http://www.jeffemminger.com

try { succeed(); } catch(E) { tryAgain(); } finally { rtfm(); }
i like your sleeves...they're real big

 

[gigard]

Shazam!!!!! When I came into work on Monday morning the code works!!!! I didn't change a thing. The server admins swear they didn't either.

Go figure. ANyway, thanks for your assistance in looking at it.