IE9 problem when running inside an iFrame (Facebook)

[Olle]

We're running an webapp inside Facebook (ASP.NET MVC3). In this app we're using KendoUI upload control and all works nice in the browsers except for IE9 that says: 

Access is denied.

kendo.upload.js?t=634716582040000000, line 1032 character 17

Line 1032 is the line form[0].submit(); (line 6 beginning from the end) below.

if (!upload.trigger(UPLOAD, e)) {

    upload._hideUploadButton();

 

    iframe.appendTo(document.body);

 

    var form = iframe.data("form")

        .appendTo(document.body);

 

    e.data = $.extend({ }, e.data, getAntiForgeryTokens());

    for (var key in e.data) {

        var dataInput = form.find("input[name='" + key + "']");

        if (dataInput.length == 0) {

            dataInput = $("<input>", { type: "hidden", name: key })

                .appendTo(form);

        }

        dataInput.val(e.data[key]);

    }

 

    upload._fileAction(fileEntry, CANCEL);

    upload._fileState(fileEntry, "uploading");

 

    iframe

        .one("load", $.proxy(this.onIframeLoad, this));

 

    form[0].submit();

} else {

    upload._removeFileEntry(iframe.data("file"));

    this.cleanupFrame(iframe);

    this.unregisterFrame(iframe);

}

[Matt]

exact same problem

[Stéphane]

Hi,

I juste solved a similar issue with IE5: Access Denied with async file upload using the Kendu UI Upload.

As recommended by our security guys we added the following header: x-frame-options: DENY

The intent was to prevent other sites to include ours inside an IFrame. But it also prevented the file uploads using an IFrame like Kendo from working...

We were able to fix it by changing the value like this: x-frame-options: SAMEORIGIN

You might want to check your headers just to be shure...