overriding GetSecurityId in IInternetSecurityManager
I have built an executable which launches a dialog box in which is embedded the IE web browser active-x control (C++).  

I want this control to allow cross site scripting. One frame on the web page loads local html, the other loads from a server. I then want the server page to call a javascript function that lives in the local html file.

 I am trying to achieve this by having the control implement it's own "IInternetSecurityManager" interface in which I am providing my own ProcessUrlAction and GetSecurityId methods.  

From what I've read, what I need to do is make GetSecurityId return the same domain for all urls.  My custom implementations are getting called, but no matter what I do, I get the "Permission denied" error when the server html tries to access script on the local html file.  Below are my implementations. Does anyone see anything wrong?


    #define SECURITY_DOMAIN "http:www.mysite.com"
    
    
    	STDMETHOD (GetSecurityId)(      
    		LPCWSTR pwszUrl,
    		BYTE *pbSecurityId,
    		DWORD *pcbSecurityId,
    		DWORD_PTR dwReserved)
    	{
    		if (*pcbSecurityId >=512)
    		{
    			memset(pbSecurityId,0,*pcbSecurityId);
    			strcpy((char*)pbSecurityId,SECURITY_DOMAIN);
    			pbSecurityId[strlen(SECURITY_DOMAIN)] = 3;
    			pbSecurityId[strlen(SECURITY_DOMAIN)+1] = 0;
    			pbSecurityId[strlen(SECURITY_DOMAIN)+2] = 0;
    			pbSecurityId[strlen(SECURITY_DOMAIN)+3] = 0;
    
    			*pcbSecurityId = (DWORD)strlen(SECURITY_DOMAIN)+4;
    			return S_OK;
    
    			
    		}
    		return INET_E_DEFAULT_ACTION;
    	}
    
    STDMETHOD(ProcessUrlAction)(
            /* [in] */ LPCWSTR pwszUrl,
            /* [in] */ DWORD dwAction,
            /* [size_is][out] */ BYTE __RPC_FAR *pPolicy,
            /* [in] */ DWORD cbPolicy,
            /* [in] */ BYTE __RPC_FAR *pContext,
            /* [in] */ DWORD cbContext,
            /* [in] */ DWORD dwFlags,
            /* [in] */ DWORD dwReserved)
    	{
    		
    		DWORD dwPolicy=URLPOLICY_ALLOW;
    		if ( cbPolicy >= sizeof (DWORD))
    		{
    			*(DWORD*) pPolicy = dwPolicy;
    			return S_OK;
    		} 
    		
    		return INET_E_DEFAULT_ACTION;
    	}
overriding GetSecurityId in IInternetSecurityManager
===

I have built an executable which launches a dialog box in which is embedded the IE web browser active-x control (C++).  

I want this control to allow cross site scripting. One frame on the web page loads local html, the other loads from a server. I then want the server page to call a javascript function that lives in the local html file.

 I am trying to achieve this by having the control implement it's own "IInternetSecurityManager" interface in which I am providing my own ProcessUrlAction and GetSecurityId methods.  

From what I've read, what I need to do is make GetSecurityId return the same domain for all urls.  My custom implementations are getting called, but no matter what I do, I get the "Permission denied" error when the server html tries to access script on the local html file.  Below are my implementations. Does anyone see anything wrong?


    #define SECURITY_DOMAIN "http:www.mysite.com"
    
    
    	STDMETHOD (GetSecurityId)(      
    		LPCWSTR pwszUrl,
    		BYTE *pbSecurityId,
    		DWORD *pcbSecurityId,
    		DWORD_PTR dwReserved)
    	{
    		if (*pcbSecurityId >=512)
    		{
    			memset(pbSecurityId,0,*pcbSecurityId);
    			strcpy((char*)pbSecurityId,SECURITY_DOMAIN);
    			pbSecurityId[strlen(SECURITY_DOMAIN)] = 3;
    			pbSecurityId[strlen(SECURITY_DOMAIN)+1] = 0;
    			pbSecurityId[strlen(SECURITY_DOMAIN)+2] = 0;
    			pbSecurityId[strlen(SECURITY_DOMAIN)+3] = 0;
    
    			*pcbSecurityId = (DWORD)strlen(SECURITY_DOMAIN)+4;
    			return S_OK;
    
    			
    		}
    		return INET_E_DEFAULT_ACTION;
    	}
    
    STDMETHOD(ProcessUrlAction)(
            /* [in] */ LPCWSTR pwszUrl,
            /* [in] */ DWORD dwAction,
            /* [size_is][out] */ BYTE __RPC_FAR *pPolicy,
            /* [in] */ DWORD cbPolicy,
            /* [in] */ BYTE __RPC_FAR *pContext,
            /* [in] */ DWORD cbContext,
            /* [in] */ DWORD dwFlags,
            /* [in] */ DWORD dwReserved)
    	{
    		
    		DWORD dwPolicy=URLPOLICY_ALLOW;
    		if ( cbPolicy >= sizeof (DWORD))
    		{
    			*(DWORD*) pPolicy = dwPolicy;
    			return S_OK;
    		} 
    		
    		return INET_E_DEFAULT_ACTION;
    	}