Difference in security handling between HTML http request and XML http request

Question

What are the differences between an HTML http request and an XML http request. I get an access denied error for this

xmlhttp.open("GET","cd_catalog.xml",false);

The xml file is in the same directory as the html file where that request is made.

Have you ruled out a problem on your server? I.e. do you get a 500 when you curl the XML but get a 200 when you curl the HTML? — Mike Samuel
– Mike Samuel, Commented Aug 10, 2011 at 1:32
It refers to that question: stackoverflow.com/questions/7004633/… — user882255
– user882255, Commented Aug 10, 2011 at 1:53
IE shows a blank page with an error message indicator. When I look at the error message it says access denied. — user823527
– user823527, Commented Aug 10, 2011 at 3:32

Mike Samuel · Accepted Answer · 2011-08-10 01:35:06Z

1

There is no difference in how XMLHttpRequest deals with XML vs HTML vs any other content-type of request.

If your server is not serving the XML at all you will see access denied.

If your server is redirecting *.xml requests to a different virtual domain or protocol, then you will see access denied because the redirect is cross-origin.

If your XML contains an external entity reference that is cross-domain, then that might cause problems as well.

answered Aug 10, 2011 at 1:35

Mike Samuel

121k30 gold badges230 silver badges255 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user823527 Over a year ago

Are there specific settings needed for the server to allow xml?

Mike Samuel Over a year ago

@user823527, Without knowing anything about your server, it's impossible to say.

Collectives™ on Stack Overflow

Difference in security handling between HTML http request and XML http request

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related