title: JavaScript permission denied. How to allow cross domain scripting between trusted domains?
body: <p>We have a .net based application hosted with SAP enterprise portal iframes.
  The domain of the SAP portal is <strong>al.xx.companyname.com</strong>. The domain of the .Net application server is <strong>ss.xx.companyname.com</strong>. </p>
  
  <p>Now when I open the application through Enterprise portal, I get a 'Permission denied' JavaScript error. I enabled script debugging in IE and then attached visual studio debugger to the JavaScript error. I noticed the error is thrown from the following JavaScript code to set/ reset dirty flags. </p>
  
  <pre><code>if(top.EPCM!=null)
  </code></pre>
  
  <p>Understandably the issue is due to cross domain scripting. i.e. the application server of ss.xx.companyname.com is trying to access the browser component of enterprise portal of domain al.xx.companyname.com.</p>
  
  <p>However this cross scripting is a trusted domain scripting and I want to somehow allow this cross scripting. I tried to set the primary DNS suffix of the application server. by following the below approach.</p>
  
  <ol>
  <li>Right click on My computer of application server. (Windows 2003 server, by the way)</li>
  <li>select properties - Computer Name</li>
  <li>Click Change button and in the next window click More button</li>
  <li>And under the'Primary DNS suffix of this computer' textbox, I entered the value - al.xx.companyname.com.</li>
  </ol>
  
  <p>Now after the above settings, I assume the domains of both enterprise portal and application server will be taken as al.xx.companyname.com. However I am still getting the JavaScript permission denied error in the same JavaScript code mentioned above.</p>
  
  <p>As suggested in the replies, I also implemented document.domain approach.</p>
  
  <pre><code>var requireddomain = 'al.xx.companyname.com';
  var text = document.domain; //returns the domain as ss.xx.companyname.com
  
  if (text != requireddomain) 
          {
              for (i=0; i &lt; 2; i++)
              {
                  dotposition = text.indexOf( "." );
                  text = text.substr(dotposition +1);
              }
              document.domain = text;
           }
  
      if(top.EPCM!=null)
  </code></pre>
  
  <p>With the above code, the document.domain object is set as <strong>companyname.com</strong> which is common to both Enterprise portal and application server.
  However still the permission denied issue is thrown in the line >> if(top.EPCM!=null)</p>
  
  <p>This issue is breaking my head for past 3 days. Can someone please help me with this?
  The objective is to allow cross domain scripting between application server and enterprise portal which is a trusted connection. Thanks.</p>
  
  <p>Update: </p>
  
  <p>Interesting &amp; frustrating development. I have installed ssl certificates in my application server. And still the permission denied error is thrown.</p>
  
  <ul>
  <li>Portal domain: al.xx.companyname.com</li>
  <li>app domain: ss.xx.companyname.com</li>
  </ul>
  
  <p>I was trying to set the document.domain property to 2 sublevels down, i.e to companyname.com.</p>
  
  <p>But still the 'permission denied error' occurs.</p>
  
  <p>I guess, the setting of document.domain will only work if the app domain is a subset of portal domain. i.e.</p>
  
  <ul>
  <li>portal domain: al.xx.companyname.com </li>
  <li>App domain: ss.al.xx.companyname.com.</li>
  </ul>
  
  <p>In the above case, I can just reduce the app domain to one sublevel down (to al.xx.companyname.com). Then I guess, it would work.</p>
  
  <p>However in my case the portal and app servers are 2 branched subdomains of the same companyname.com and hence cross scripting is still not allowed.</p>
  
  <p>Any suggestions on how to proceed?</p>