all groups > dotnet security > july 2004 >
You're in the

dotnet security

group:

SecurityPermission failed on ActiveX when accessing remote server


SecurityPermission failed on ActiveX when accessing remote server anderswg NO[at]SPAM gmail.com
7/22/2004 3:53:13 AM
dotnet security:
Hi,
I'm trying to make a web page that gathers data from different web
servers using JavaScript and ActiveX.


I have tried to make an ActiveX in c# .NET,
but I get an error message when I try to connect to the remote server
with my ActiveX control.
"Request for the permission of type
System.Security.Permissions.SecurityPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
failed."


Is it possible to add some security-features to my ActiveX, or is the
only way to grant trust on all clients?
Will an ActiveX made in VB6 have the same restrictions?
Is there any other way to retrieve data from multiple different
servers into one web page? (both GET and POST requests)


mvh
Re: SecurityPermission failed on ActiveX when accessing remote server Nicole Calinoiu
7/22/2004 7:07:37 AM
Anders,

Since you haven't mentioned exactly what your code is doing when the
exception is raised, it's a wee bit difficult to even begin to guess what
permission is being denied. That said, using an ActiveX control might be
overkill if you merely need to make HTTP requests to multiple servers from
within one page. Have you considered using frames or iframes instead?

HTH,
Nicole



[quoted text, click to view]


Re: SecurityPermission failed on ActiveX when accessing remote server anderswg NO[at]SPAM gmail.com
7/22/2004 2:35:32 PM
[quoted text, click to view]

Yes, I tried to use javascript to control a frame or iframe, but when
the frame enters a different domain, i have no access to the
frame-object anymore.

The main purpose is to access a few different webservers, and present
the result on one page.


ex:

alert(myFrame.document.form1.innerHTML); // <- this line works fine
myFrame.location = "http://www.somedomain.com";
// maybe wait for page to be redirected
// and when loaded:
alert(myFrame.document.form1.innerHTML); // <- this line gives me an
"Access is denied" exception

I have also tried to use MSXML2.XMLHTTP and similar:

var xmlhttp = new ActiveXObject("MSXML2.XMLHTTP");
xmlhttp.open("GET", "http://www.somedomain.com", false);
xmlhttp.send();

But this gives me an "Permission denied" exception.


So my thoughts was if i could make an ActiveX that were thrusted by
the browser to access remote servers, it would work.

Or is there a way to programaticly add a website to the "Trusted
zone", giving the user a question if he/she wants to approve the code?

Re: SecurityPermission failed on ActiveX when accessing remote server Nicole Calinoiu
7/23/2004 7:48:46 AM
Anders,

If there was a way to add a site to the trusted zone from within code
running on the site, what would prevent malicious site operators from
promoting their sites to trusted status? In your case, instead of
attempting to add your site to the trusted zone via code, why not simply
display a message indicating that this must be done by the user in order for
that portion of the code to run?

That said, if this is critical functionality on your site, it might not be a
good idea to leave the aggregation up to the client. Besides the obvious
cross-site-scripting protections that are coming into play, you'll also
probably hit some more general browser-compatibility issues unless your
clients are standardized on one browser. It might be a better idea to
aggregate the data via server-side code unless you are unable to support the
resultant load on the server.

HTH,
Nicole


[quoted text, click to view]

AddThis Social Bookmark Button