Access data sources across domains

since 0.9.8.11

Purpose

Show registry keys (2)

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1406
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1406

This security-zone policy controls cross-domain data access through Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO) for content in the Internet Zone. The 3 in the registry path identifies the Internet Zone, while the value name 1406 represents the URLACTION_CROSS_DOMAIN_DATA URL action.

The value uses the REG_DWORD type and the following URL policy values:

0: Allow the action without prompting
1: Prompt the user before allowing the action
3: Do not allow the action

The setting applies specifically to access evaluated through this URL action for MSXML or ADO. It does not enable or disable every form of cross-origin network access.

Notes

Security

Allowing the action relaxes cross-domain separation for the affected MSXML and ADO operations. Subject to the other technical requirements of the requested resource, Internet Zone content can access data associated with another site. A malicious or compromised page could misuse this capability to disclose or modify data that is otherwise reachable through these components.

The setting does not grant general operating-system privileges or unrestricted access to files, databases, or network resources. Whether an operation succeeds also depends on the target data source, its availability, and its access controls.

A value of 1 leaves the decision to the user. A value of 3 blocks access governed by this URL action.

Possible side effects

Legacy web applications that depend on MSXML or ADO for cross-domain data access can stop working when the value is 3. With a value of 1, their operation depends on user confirmation and may be interrupted by recurring security prompts.

Notes

The HKLM and HKCU paths represent the computer and user scopes of the same ADMX-backed policy.

The setting also affects pages rendered by the legacy MSHTML engine in Microsoft Edge Internet Explorer mode because IE mode evaluates Internet Explorer security-zone settings. Pages rendered normally by the Chromium engine are not governed by this Internet Explorer URL action.