title: "Access is Denied" on contentDocument in IE9 on same domain
body: <p><strong>Short/Generic Version:</strong></p>
  
  <p>I'm working on an application that (unfortunately, for other reasons), sets <code>document.domain</code> at the top of every page to a substring of the "true" domain: for subdomains like <code>sub.app.local</code>, <code>document.domain = "app.local"</code>. I'm also creating an iframe dynamically and adding it to the page. The iframe loads a file residing on the same server as the parent page. Later on, some Javascript needs to access the <code>contentDocument</code> property of the iframe.</p>
  
  <p>This is fine in modern browsers, but causes problems in IE9 due to <a href="https://stackoverflow.com/q/1886547/3191599">this bug</a>. (See the <a href="https://stackoverflow.com/a/1888711/3191599">top answer</a> for a good explanation of why this is.) AFAIK, every browser newer than IE9 automatically inherits <code>document.domain</code> for programmatically-created iframes, so this is IE9-specific. Because of some of the unique requirements of my scenario (tldr: the iframe src needs to change), the answer in the above post didn't work for me.</p>
  
  <p><strong>Longer/Application-Specific Version:</strong></p>
  
  <p>I'm using FineUploader in an application running on IIS, uploading files to S3. Everything's working just fine in modern browsers, but IE9 support is giving me trouble, even after following the docs (<a href="http://blog.fineuploader.com/2013/08/16/fine-uploader-s3-upload-directly-to-amazon-s3-from-your-browser/#success-redirect" rel="nofollow noreferrer">Supporting IE9 and older</a>) to configure the <code>iframeSupport.localBlankPagePath</code> option. I'm a little stumped!</p>
  
  <ul>
  <li>I've tried this on FineUploader 4.0.3 and also 5.0.3.</li>
  <li>Everything works fine in IE11. If I switch Document mode to 9 in the F12 console, it breaks.</li>
  <li>I don't have CORS support turned on, because I'm not loading anything from a different domain.</li>
  <li>I have a dummy/blank file on the same domain as my page.</li>
  <li>I can see (in the Network panel) the HTTP 303 response from AWS that includes the <code>Location</code> key, and a value that points to my blank document. If I paste the entire URL into the address bar, the page loads fine and is blank as expected.</li>
  <li>I've tried adding <code>X-Frame-Options SAMEORIGIN</code> to the server's response headers, as suggested <a href="http://davidwalsh.name/iframe-permission-denied" rel="nofollow noreferrer">here</a>, but it didn't help.</li>
  </ul>
  
  <p>The error that I get in the console is:</p>
  
  <pre><code>[Fine Uploader 5.0.3] Error when attempting to access iframe during handling of upload response (Access is denied.
  )
  [Fine Uploader 5.0.3] Amazon likely rejected the upload request
  </code></pre>
  
  <p><br><br>
  <strong>UPDATE</strong></p>
  
  <p>I've determined that the reason it's not working out-of-the-box is because the application sets <code>document.domain</code> on page load, and it's different than (a subset of) <code>location.host</code>. FineUploader's 303 redirect mechanism to the blank page is working fine, but the <code>document.domain</code> of the iframe differs from the parent (due to IE9 not inheriting the property) and so, access denied.</p>
  
  <p>The actual S3 upload is <strong>working</strong>. It's just the final step of verifying the upload that fails.
  <br><br></p>
  
  <p>Here's my client-side code:</p>
  
  <p>FineUploader.js</p>
  
  <pre><code>var fu = namespace('App.FineUploader');
  fu.DocId;
  fu.ClientDeployId;
  fu.viewModel;
  fu.defaultAttachmentEndpoint = "https://s3.amazonaws.com/App.UploadBucket";
  fu.FineUploaderController = "FineUploaderDocAttachment";
  
  fu.delete = function (documentAttatchmentID, attachmentID) {
      var data = documentAttatchmentID;
      $.ajax({
          type: "POST",
          url: App.BaseUrl + "/api/" + fu.FineUploaderController + "/delete",
          data: JSON.stringify(data),
          success: function () {
              $('#fineUploader' + attachmentID).fineUploader('reset');
              $('#fineUploader' + attachmentID).show();
              $('#aDownloadfineUploader' + attachmentID).html('');
              $('#aDownloadfineUploader' + attachmentID).hide();
              $('#aDeletefineUploader' + attachmentID).hide();
          },
          dataType: 'json',
          contentType: 'application/json'
      })
  }
  
  fu.lockAll = function () {
      $('.fineUploader').hide();
      $('a[id^="aDeletefineUploader"]').hide();
  }
  
  fu.init = function (sID) {
      $('#' + sID).fineUploaderS3({
          request: {
              endpoint: fu.defaultAttachmentEndpoint,
              accessKey: "[key]",
              params: {
                  documentid: $('#' + sID).attr('documentid'),
                  attachmentid: $('#' + sID).attr('attachmentid')
              }
          },
          signature: {
              endpoint: App.BaseUrl + "/api/" + fu.FineUploaderController + "/signtureHandler"
          },
          uploadSuccess: {
              endpoint: App.BaseUrl + "/api/" + fu.FineUploaderController + "/success"
          },
          iframeSupport: {
              localBlankPagePath: App.BaseUrl + "/Scripts/FineUploader/4.0.3/html/blank.html"
          },
          objectProperties: {
              key: function (fileId) {
                  var keyRetrieval = new qq.Promise(),
                      filename = $('#' + sID).fineUploader("getName", fileId);
                  var documentid = $('#' + sID).attr('documentid');
                  var attachmentid = $('#' + sID).attr('attachmentid');
                  var data = { name: filename, documentId: documentid, attachmentId: attachmentid }
                  $.ajax({
                      type: "POST",
                      url: App.BaseUrl + "/api/" + fu.FineUploaderController + "/preUpload",
                      data: JSON.stringify(data),
                      success: null,
                      dataType: 'json',
                      contentType: 'application/json'
                  }).done(function (data) {
                      keyRetrieval.success(data.key);
                  }).fail(function () {
                      keyRetrieval.failure();
                  });
                  return keyRetrieval;
              }
          },
          validation: {
              itemLimit: 1
          },
          chunking: {
              enabled: true
          }
      }).on('error', function (event, id, name, errorReason, xhrOrXdr) {
          alert(qq.format("Error on file number {} - {}.  Reason: {}", id, name, errorReason));
      }).on('complete', function (event, id, name, response) {
          if (fu.FineUploaderController === "FineUploaderDocLibraryAttachment") {
              $('#' + sID).fineUploader('reset');
              App.Contracts.Create.ReloadImageLibraryList(true);
              App.Contracts.Create.HideLoader();
          } else {
              $('#aDownload' + sID).attr('href', response.url);
              $('#aDownload' + sID).html(response.name);
              $('#aDownload' + sID).show();
              $('#aDelete' + sID).show();
              $('#aDelete' + sID).attr('onclick', 'App.FineUploader.delete(' + response.daId + ',' + sID.replace('fineUploader', '') + ');');
              $('#' + sID).hide();
          }
      }).on('submitted', function () {
          if (fu.FineUploaderController === "FineUploaderDocLibraryAttachment") {
              App.Contracts.Create.ShowLoader();
          }
      });
  }
  </code></pre>