Internet Explorer iframe JavaScript access denied

Question

I have a webpage on domain www.example.com that has an <iframe> with a page test.html from sub.example2.com. test.html includes a JavaScript from another domain:

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.1/jquery.min.js"></script>

When I open www.example.com then I get an access denied error for that JavaScript.

What's the reason for that?

Solution

This is due to the "Same Origin" security policy.

The “Same Origin” policy limits the access of one window to another.

The reason behind that is security. If you have blabla.com in one window and gmail.com in another one, then you’d not want a script from blabla.com to access or modify your mail or run actions in context of gmail on your behalf.

The essence of the Same Origin policy can be formulated as: windows can work in contexts of each other only if they are from same protocol://domain:port, or, shortly, from same origin.