title: Firefox 23 and IE10 no longer playing nice with my XMLHttpRequest, I have CORS in php
body: <p>I have this bit of java script that is just grabbing an ID off a website and passing it to another php script on a seperate domain:</p>
  
  <p>javascript is on:</p>
  
  <p><a href="https://myspot.com" rel="nofollow">https://myspot.com</a></p>
  
  <p>and is going to</p>
  
  <p><a href="http://theotherwebsite.edu" rel="nofollow">http://theotherwebsite.edu</a></p>
  
  <p>This was more or less working, I had to work a previous cross site solution that now seems not to be honored on firefox 23 and IE10.</p>
  
  <p>The previous solution was using something like this:</p>
  
  <pre><code> var isIE10 = false; //this is beacuse stupid IE10 now does not work with the window.XDomainRequest
   /*@cc_on
       if (/^10/.test(@_jscript_version)) {
           isIE10 = true;
       }
   @*/
   console.log(isIE10);
   var isIE8 = window.XDomainRequest ? true : false; 
  
   var invocation=createCrossDomainRequest();
  
  function createCrossDomainRequest(url, handler)
  {
          var request;
          if ((isIE8) &amp;&amp; (!isIE10)) //tried to hack my own isIE10 fix didnt work
          {
              request = new window.XDomainRequest();
          }
          else
          {
              request = new XMLHttpRequest();
          }
          return request;
  
  }
  
   function callOtherDomain()
      {
          if (invocation)
          {
              if("withCredentials" in invocation) //was taking a stab in the dark with this.
              {
                  invocation.onload=outputResult;
                  invocation.open("GET", url, true);
                  invocation.send();
  
              }
  
              else if(isIE8)
              {
                  invocation.onload = outputResult;
                  invocation.open("GET", url, true);
                  invocation.send();
              }
              else
              {
                  invocation.open('GET', url, true);
                  invocation.onreadystatechange = handler;
                  invocation.send();
              }
          }
          else
          {
              var text = "No Invocation TookPlace At All";
              var textNode = document.createTextNode(text);
              var textDiv = document.getElementById("textDiv");
              textDiv.appendChild(textNode);
          }
      }
  function handler(evtXHR)
      {
          if (invocation.readyState == 4)
          {
              if (invocation.status == 200)
              {
                  outputResult();                 
              }
              else
              {
                  alert("Invocation Errors Occured " + invocation.status + " state: " + invocation.readyState);
              }
          }
      }
  
      function outputResult()
      {
            var response = invocation.responseText;
  
  
                      //get JSON of response
          var obj = JSON.parse(response);
          var mtype = obj.messagetype;
          var output = obj.message;
          var url = obj.url;          
  
          if(mtype=="error")
          {               
              parent.location=url;
          }
          else if(mtype=="warning")
          {
              var answer=confirm(output);
              if(answer)
                  parent.location=url;
  
          }
  
  
          //var textDiv = document.getElementById("textDiv");
          //textDiv.innerHTML += response;
  
      }       
  </code></pre>
  
  <p>callOtherDomain();
  So I am not sure what is going on here, I get on firefox 23 an error in the console:</p>
  
  <p><code>Blocked loading mixed active content "http://theotherwebsite.edu"</code></p>
  
  <p>I know this is because the main script is loaded on https, vs http.  But it was not caring before.  I also am aware of this error puts a shield up in the address bar of firefox where the user can tell it to enable the blocked content.  This is not an acceptable solution for me.  Also if i put my silly little php script under https, that is a certificate I need too?</p>
  
  <p>Then IE10 just doesn't work:</p>
  
  <p><code>SCRIPT5: Access is denied.</code>
   <code>landing, line 64 character 421</code></p>
  
  <p>So I am not sure what I need to do to get my code working again, having the user adjust the browser isn't feasible cause this is distributed enterprise wide, it was for a nag screen to let them know to change their password based on some ldap entry that the php file accesses with the ID passed from the website via ajax.</p>
  
  <p>I was doing some googling but found nothing, most I found was the php handle to make the website I guess CORS compatible:</p>
  
  <pre><code>&lt;?php
   header('Access-Control-Allow-Origin: *');
  </code></pre>
  
  <p>Which I implemented originally as well.  So not sure what to try or where to look next?  It is a simple JSON string that comes back, can I try the preflight method as described here: </p>
  
  <p><a href="http://ppe.blogs.msdn.com/b/ie/archive/2012/02/09/cors-for-xhr-in-ie10.aspx" rel="nofollow">http://ppe.blogs.msdn.com/b/ie/archive/2012/02/09/cors-for-xhr-in-ie10.aspx</a></p>
  
  <p>???  if i do I am not sure what the headers should look like.</p>
  
  <p>I was going to post the firefox 23 response header but it never makes the request as it straight up blocks the loading mixed active content.  So I guess I have two issues to contend with, one that the javascript lives on https and makes  a call to http...this might be my only issue in firefox, not 100% sure if i would have cross site issues.</p>
  
  <p>IE10 the network request header is never find and I am looking inside the F12 key pressed area in IE10, under network and I click start capturing before I load the page with the xhr call.</p>
  
  <p>So I guess I am asking what changed in firefox23 and IE10 to not let my code work anymore?</p>