Access is denied. JavaScript error on request to secured page

On page SomePage.aspx, by JavaScript code (XMLHttpRequest) I call SecuredPage.aspx used next code:

    var httpRequest = GetXmlHttp();
    var url = "https://myhost.com/SecuredPage.aspx";

    var params = "param1=" + document.getElementById('param1').value +
                "&param2=" + document.getElementById('param2').value;

    httpRequest.open("POST", url, true);
    httpRequest.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

    httpRequest.onreadystatechange = function() {
        //Call a function when the state changes.
        if (httpRequest.readyState == 4 && httpRequest.status == 200) {
            alert(httpRequest.responseText);
        }
    }
    httpRequest.send(params); // HERE ACCESS IS DENIED.

    //---------------------------------------------
    function GetXmlHttp() {
        var xmlhttp = false;
        if (window.XMLHttpRequest) {
            xmlhttp = new XMLHttpRequest();
        }
        else if (window.ActiveXObject)
        // Code for Internet Explorer.
        {
            try {
                xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
            }
            catch (e) {
                try {
                    xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
           开发者_如何学编程     } catch (E) {
                    xmlhttp = false;
                }
            }
        }
        return xmlhttp;
    }

It throws an Access is denied error. If send to http (http://myhost.com/SecuredPage.aspx), it works fine.

How is it possible to resolve this problem?

If you wish to fetch an HTTPS page via Ajax you need to do it from an HTTPS page on the same domain, there is no other way, as long as you use Ajax. This is because of the same origin policy.

That said, there are plenty of ways to do this not using Ajax, for instance you can use frames.

Another way is to use JSONP, but this requires that you are fetching, well, JSON :)

A third way, that tends not to be very useful for production websites, but still can be fun to tinker around with, is to use YQL as a proxy.

Lastly you can always set up a serverside proxy of your own, so that you call an HTTP address that fetches the HTTPS page and sends it on, but this is rarely a good solution if it can be avoided.

This is because the browser considers http and https as 2 different sites/domains, and therefore you have to adhere to the same origin policy.

Due to browser security restrictions, most "Ajax" requests are subject to the same origin policy; the request can not successfully retrieve data from a different domain, subdomain, or protocol.

One way to solve it is using jsonp.

As it's been said, your problem is that your browser sees this as a cross domain request. Another way to accommodate this is to set up a crossdomain.xml file like this:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
  <allow-access-from domain="myhost.com" />
  <allow-access-from domain="ourhost.com" />
  <site-control permitted-cross-domain-policies="master-only" />
</cross-domain-policy>

I'm not an expert on this method, but I have used it successfully. Other domains can be added by adding more allow-access-from tags. You may need to do some fiddling. YMMV.