title: Read file:// URLs in IE XMLHttpRequest
body: <p>I'm developing a JavaScript application that's meant to be run either from a web server (over http) or from the file system (on a file:// URL).</p>
  
  <p>As part of this code, I need to use XMLHttpRequest to load files in the same directory as the page and in subdirectories of the page.</p>
  
  <p>This code works fine ("PASS") when executed on a web server, but doesn't work ("FAIL") in Internet Explorer 8 when run off the file system:</p>
  
  <pre><code>&lt;html&gt;&lt;head&gt;
  &lt;script&gt;
  window.onload = function() {
    var xhr = new XMLHttpRequest();
    xhr.open("GET", window.location.href, false);
    xhr.send(null);
    if (/TestString/.test(xhr.responseText)) {
      document.body.innerHTML="&lt;p&gt;PASS&lt;/p&gt;";
    }
  }
  &lt;/script&gt;
  &lt;body&gt;&lt;p&gt;FAIL&lt;/p&gt;&lt;/body&gt;
  </code></pre>
  
  <p>Of course, at first it fails because no scripts can run at all on the file system; the user is prompted a yellow bar, warning that "To help protect your security, Internet Explorer has restricted this webpage from running scripts or ActiveX controls that could access your computer."</p>
  
  <p>But even once I click on the bar and "Allow Blocked Content" the page still fails; I get an "Access is Denied" error on the xhr.open call.</p>
  
  <p>This puzzles me, because <a href="http://msdn.microsoft.com/en-us/library/ms537505%28VS.85%29.aspx" rel="noreferrer" title="About Native XMLHTTP">MSDN</a> says that "For development purposes, the file:// protocol is allowed from the Local Machine zone."  This local file should be part of the Local Machine Zone, right?</p>
  
  <p>How can I get code like this to work?  I'm fine with prompting the user with security warnings; I'm not OK with forcing them to turn off security in the control panel.</p>
  
  <p><strong>EDIT:</strong> I am not, in fact, loading an XML document in my case; I'm loading a plain text file (.txt).</p>