0

Just curious to know:

How to Enable ->Access data sources across domain<- in IE, using CMD only and NOT by changing the registry or group-policy.


I know that the following command works for the Google-Chrome-Browser:

chrome.exe --disable-web-security "https://example.com"

*(that argument disables the same-origin-policy for the so executed instance of chrome/chromium) (Version 48+ requires --user-data-dir="D:\User-Data.d\", too)*


I need a similar command for InternetExplorer on Windows Server 2012 (IE-Version: 10 | 11).


Note: A manual way to enable the cross-domain-access would be via:

'Internet Options -> Security -> Miscellaneous -> Access data sources across domain -> enable'.

But i don't want to do this. Neither by editing the registry, nor by refining the group-policy.


I am looking for a solution to 'Enable' this feature for a running IE-instance on-demand.

1 Answers1

2

(As far as i can remember and tell ...)

You can't

As you already pointed out in your question, you have the possibility to change the setting to 'Access data sources across domain', which in general should allow to operate e.g by XMLHttpRequest | ADO across domains;

As you also noticed and noted, that you can execute Google Chrome by given argument "--disable-web-security" from the CMD-Shell, the perspective seems to wander to a tender web-perspective, so i will use vocabulary that hopefully may ease the readers understanding.


--disable-web-security

... also to the web known as Cross-Site-Scripting (shortened: XSS); If broadened to b2b-networks you may call it a feature, because MicroSoft tried to push it for over a decade as such, from around 2005 on.

To be precise: It is not a feature in environments handling private data, which exactly nullifies MicroSofts publishings, as they have been known for being based on what in 1998 already has been seen as an insecurity-possibility;

In 2003 | 2004

AJAX was the first non-aggressive use-case that became globally prominent due to IE supporting a limitless XMLHttpRequest.

This in turn became the fundament, for the sheer mass of web-apps, content-management-systems, modular javascript libraries and so on.

Back then we called it Web 2.0.

Without these asynchronous calls of parts of data, especially across domains, there would be almost none of it at all;

It is also one pillar of the CDN (Content Delivery Network) that allows us consuming data from nearly any point and type of access given, in unbelievably short reaction time and with transfer speed, that even nowadays feels utopic.


It can be source for a feature

, but only if you wish to spread and | or collect as much data as possible.

The latter is called Scraping, or ironically simplified: "App".


To get to your question in a bit more detail ( before finally trying to guess what your question possibly aimed at | what you are targeting ) ...


Let's walk backwards:

to 'Enable' only for the running IE instance on demand

The reason why it is possible to start a Chrome- | Chromium- -"Instance" is that that browser really starts "new" instances, meaning these are truly separated from each other. You can prove that, by looking into chrome's task-manager, which you will find in your SysTray as a minified Chrome-Icon. This allows also to open one or more browser-windows bound to a specific user profile, to which that | these instance/s then are synched to; as chrome enables you to synchronize your contents | add-on's | favorites | etc. by linking your experience to your Google-Account.

Why you do not open an "Instance" of Internet-Explorer

(regardless of Version or NT-5+ based Windows-Operating-System) in the way i already assumed you might want to:

Simply, because whereas Chrome first starts the Environment which enables the creation of separated sand-boxes for the browser-windows you actually can well see and operate in the end, these Core-Components are basically running all the time in your Windows OS;

The network access with all the needed protocol- and access-rights- -handling on top, which your wanted feature would rely on is part of the main system and can not be instantiated.


You know, but might not realize that you for sure can change the Internet Settings. But where do you do that and why should you ask that?

A) You use the settings menu in Internet Explorer, which is in effect the same as ..

B) The Internet Control Panel (take a look at this reference, if you run your Windows Server 2012 in Core mode, it generally comes in handy).


To compress that info above a bit ...


When Chrome starts

... , you are enabled to run it in standard mode, which is represented by the Chrome-Task-Manager and a Browser-Window, which might be already synchronized, due to the linking to your Google-Account. --- I think that is what you meant by instance in general. --- And you are right; In that case, what you can see, is an instance.

When Internet Explorer starts

... , you effectively start only an instance of the Graphical User Interface of IE. The Browser itself (the Environment the GUI is based on) essentially is what you run, when you run Windows.


[The last Version of Internet Explorer that happened to be a single-application, that runs on it's own was (i can't remember exactly) IE 4? Should have happened around the millenium (Windows 98 SE | Windows 2000 ), when the fundamentals of the Browser found their way in essential parts into the Operating-system itself. There's much more to explore about it for those that want to. But before my first answer has to be printed on a whole tree, i'd better stop, right? Ah, sorry; there's some left!]


I hope you see, that it is impossible to do what you want.


What you can do instead and i think these are your only options:

Run a minimized install of Windows; The Most possibly simple way to achieve that 'total minimization around one focused app' is possible due to Dino Nuhagic and his very well known tool nLite. Whereas the only purpose to run it in this case, is to be able to make use of Internet Explorer in combination with the following two (one and only) options you have to do that:

1: Allow Cross-Site-Scripting | XSS | Access data sources across domain via: Group-Policy Settings, made effective on Boot of the Windows OS GUI;

2: Enable the feature in the way you already mentioned in your Question via: Internet Options -> Security -> Miscellaneous -> Access data sources across domain->enable , which can take effect (with some luck and dependent of what applications and features and services are running in your minified Windows OS) ..

a: immediately after closing the Settings Dialog and IE itself

b: after you have logged out and logged back in

c: after killing explorer.exe and starting it again

... or as in the first case:

After a clean shutdown and reboot of your minimized Windows OS, which you can deploy for immediate use, for example (in ascending order for difficulty to setup and descending order of my personal preferences) with:

A: VMWare WorkStation Player

B: Oracle VirtualBox

C: Hyper-V

D: QEmu

You technically have a lot more options, take these recommendations based on the premise, you are indeed using something inbetween Windows 8 | Server 2012 up to Windows 10 | Server 2016 with a GUI or via RDP | noVNC | and the likes. But if i have overseen an essential tool which allows one to do the same, please correct this mini-list accordingly just for the sake of completeness.


This was definitely not of help regarding your question, but i at least hope i might have pleased your curiosity on that topic.


If i totally guessed wrong and you aimed at breaking into the Windows Host System by executing hostile code via reverse injection through misformed http-requests using localhost calls of non-existent binary-data ...

Well then you should look out for the terms: "White Hat , localhost , Windows , Cross-Site-Scripting , Vulnerability , XSS , UXSS , ADO , XMLHttpRequest" ; These are more than enough and should in the end of your research deliver the same result, that what you want to do is only possible through Allowance via GP (and therefore not for the running system, incl. IE; or you will be able by Hacking your way through to the very core. Both ways end up in mental exhaust, believe.


Hope it helps.


P.s.: This is my first post and if i have understood the rules correctly i am not able to comment, so if i did anything completely wrong, please consider to use this Q and A as an openly edited and commented example for newbies like i am. Thanks.

I address this especially because the one and only reason i registered to StackExchange was this post: Stack Overflow Isn’t Very Welcoming. It’s Time for That to Change.