XMLHttpRequest Cross-domain Request Security configuration under ie7+ Browser

Note: The version of Firefox 3.5, Chrome 3.0, and Safari 4 is not a problem with XMLHttpRequest.

ie7+ Browser has started to support XMLHttpRequest objects, when using XMLHttpRequest to request files of different sources (pages of different domain names), and whether the browser is enabled security-"Access data source through domain" in the Internet zone. If this option is enabled, all cross-domain pages are accessible, even if the cross-domain page does not have a Access-control-allow-origin response header set. If the "Access data source through the domain" is disabled, the cross-domain page is set to the Access-control-allow-origin response header is * and cannot be requested, and an error occurs when open.

Note: If you double-click to run or drag into Internet Explorer, the XMLHttpRequest object cannot request local resources, there will be an " Access denied " error, ActiveXObject created objects are not limited, specific reference: the site is not published, What are the local resources that Ajax can request.

<script>
/*var xdr=new XMLHttpRequest ();
Xdr.open ("Get", ' 11.txt ', true); Local test accesses local resource with Access denied error
Xdr.open ("Post", ' http://www.coding123.net/json.asp ', true); If the "Access data source through the domain" is disabled, the cross-domain page is set to the Access-control-allow-origin response header is * and cannot be requested, and an error occurs when open.
Xdr.onreadystatechange = function () {
if (xdr.readystate = = 4) alert (Xdr.responsetext)
}
Xdr.send (NULL) */
</script>

If security is not enabled-the "Access data source through domain" in the Internet zone, the cross-domain page has a access-control-allow-origin response header that allows page requests of all different sources, ie how to request such pages to get the content of cross-domain pages. You can use IE's proprietary Xdomainrequest object.

<script>
var xdr = new Xdomainrequest ();
Note the Xdomainrequest object local browse (double-click or drag-and-drop) cannot request a cross-domain page, or "Deny access." ”，
Web sites need to be published, and cross-domain requests support only http://and https://2 protocols.
Cross-domain pages to be set over Access-control-allow-origin response header is *, no response, no error.
Xdr.open ("Post", ' http://www.coding123.net/json.asp ');
Xdr.onload = function () {
Alert (Xdr.responsetext)
}
Xdr.send (NULL);
</script>

Http://www.coding123.net/article/20130813/IE-XMLHttpRequest-cros-request-safe-config.aspx