What does this JavaScript error mean? Permission denied for calling a method in Location.toString

Question

This error began to appear on the entire site.

Permission denied for calling Location.toString method

I see google posts that suggest this is related to flash and our crossdomain.xml. What caused this and how do you fix it?

Answer 1

Do you use javascript to communicate between frames / iframes that point to different domains? This is not permitted by the JS security policy of "same origin / domain". That is, if you have

<iframe name="foo" src="foo.com/script.js"> <iframe name="bar" src="bar.com/script.js"> 

And the script on bar.com is trying to access window["foo"].Location.toString , you will get this (or similar) exception. Also note that the same origin policy can also work if you have content from different subdomains. Here you can find a brief and detailed explanation of this with examples.

Answer 2

You may have come across this publication , but it seems the update for the Flash update has changed the behavior of crossdomain.xml, requiring you to specify a security policy that allows you to send arbitrary headers from a remote domain. The Adobe Knowledge Base article (also mentioned in the original post) here .

Answer 3

This post assumes that there is one line that should be added to the crossdomain.xml file.

 <allow-http-request-headers-from domain="*" headers="*"/> 

Answer 4

This is probably due to a change in the version of Flash Player released in early April, I'm not too sure about the specifics, but I assume that there were security issues with this functionality.

What you need to do is add this to your crossdomain.xml (which should be located on your web server)

You can read more here: http://www.adobe.com/devnet/flashplayer/articles/flash_player9_security_update.html

A typical example of crossdomain.xml is twitters , more detailed information on how the file works can be found here.