IE10 and IE11 SCRIPT5 Acess is Denied error when attempting a CORS request using XMLHttpRequest

Question

I'm not using jquery, just vanilla javascript. My site is hosted on a domain, let's say it's example.com

When running the following code:

var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://www.example2.com', true);

I get an error:

SCRIPT5: Access is denied

This code works fine in other browsers (chrome, safari).

Also, this only seems to break when running it on my site. When I run that snipped of code from the IE 11 console, on other sites around the web, the error does not occur.

Do I need to set any specific headers on the site that's hosting the script? Or on the site that's loading the script?

Answer 1

Figured out the reason, it was very odd, and because of some crappy legacy code sitting on the site!

This meta tag existed in the header:

<meta http-equiv="X-UA-Compatible" content="IE=9" />

Which was telling IE to run as IE9, and IE9 has a different mechanism for doing cross-domain requests.

Answer 2

I can use XMLHttpRequest as follows:

var req = new XMLHttpRequest();
req.open('GET', 'http://home.arcor.de/martin.honnen/cdtest/test2011060701.xml', false);
req.send();
var xml = new XMLSerializer().serializeToString(req.responseXML);
console.log(xml);

The directory on the server is configured to allow any requests from other origins, sending the Access-Control-Allow-Origin:* response header.

I tested with Firefox, Chrome and IE on Windows 8.1.