socket.io Access Denied in iE10 on SharePoint2013

Question

Hya,

I'm running a socket.io server in a NodeJS enviroment under HTTPS. The js Code which calls my app to start the communication with my socket.io server runs on a sharePoint 2013 instance (Office 365).

If I visit my page in Chrome or Firefox everything works perfectly fine. In iE10 I get the following waring from the socket.io client in the console

SCRIPT5: Access is denied. 
socket.io.js, line 1641 character 9

which is the following line

    xhr.open('GET', url, true);

It seems that either the iE or the IIS from the SharePoint assumes an XSS while using jsonp/xhr - polling. The configured transports are

'jsonp-polling'
'websocket'
'xhr-polling'

in that order. We use

SocketServer 0.9.16
SocketClient 0.9.11

Just for testing purposes I just set

   io.util.ua.hasCORS = false;

on line 1626 which helps, but leads of course to a security warning allá

SEC7130: Potential cross-site scripting detected

Does anyone know what I'm doing wrong or what is the problem here? Thanks in advance!

edit after I did some more research I found the following discussion on googleGroups. Also I commented my GitHub Issue

Due to security reasons you have to connect to same server and port in order to prevent any CORS. Modern browsers might ignore it in certain circumstances, and some will implement extra ability to overcome it by headers or so, but generally it is not well supported, so you have to try to have WebSockets on same domain (not necessary server) as HTML is server from.

theSilverFisch · Answer 1 · 2013-07-10 08:32:17Z

Fixed! The solution is that you have to add a p3p header bevor you send the cookie. The header should look something like that

res.setHeader("p3p", "CP=\"COM CNT DEM FIN GOV ONL OTC PHY ALL DSP NID OHO CUR OUR BUS IND LEG NOR STP\"");

asked	3 months ago
viewed	145 times
active	2 months ago

socket.io Access Denied in iE10 on SharePoint2013

1 Answer

Your Answer

Not the answer you're looking for? Browse other questions tagged javascript node.js socket.io internet-explorer-10 sharepoint2013 or ask your own question.

socket.io Access Denied in iE10 on SharePoint2013

1 Answer

Your Answer

Sign up or login

Post as a guest

Not the answer you're looking for? Browse other questions tagged javascript node.js socket.io internet-explorer-10 sharepoint2013 or ask your own question.

Related