Internet Explorer, Cross-Domain-iFrames and unusable Select Boxes

Microsoft has done it again: Just noticed that some customers aren’t able to open select boxes in some iFrames when using IE7.

After some investigation and prototyping i came up with the following:

Problem

Select boxes in iFrames may not be opened anymore.

Analysis (short)

Microsoft has busted iFrame interaction in IE7 via windows update.

Analysis (long)

With IE7, Microsoft has introduced a security concept to deal with Cross-Frame-Scripting: http://msdn.microsoft.com/en-us/library/ms533028%28v=vs.85%29.aspx

This security layer prevents JavaScript from interacting between the iFrame-Scope-Border if the iFrame gets hosted on another domain as the including page.

After running Windows-Update, those security restrictions also covers basic interaction with Select-Boxes: If served via another domain, Internet Explorer circumvents users to open Select-Boxes in iFrames.

If we set up a valid document.domain constallation between container page and iFrame, Select-Boxes may be used correctly again.

Conclusion

Opening Select-Boxes with the mouse has nothing to do with Cross-Frame-Scripting imho: This is a major bug in Internet Explorer 7.

Workarounds

• Serve iFrame content via the same domain as the container page
• Serve iFrame content via a subdomain of the domain serving the container page. Correctly set up document.domain on both pages (container, iFrame)

Update 2011-11-22

Seems this was caused by the Cumulative Security Update for Internet Explorer: October 11, 2011.

LOL: Microsoft itself advices to update to IE8/IE9 or to install a hotfix for IE7 as described in Knowledgebase Article 2628724 – That means your visitors have to install a browser-hotfix to use a normal iframed page correctly.