Access data sources across domains

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1406
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1406

The 1406 value controls the URLACTION_CROSS_DOMAIN_DATA URL action for the Restricted Sites Zone. It determines whether a page running in this zone can use Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO) to access a data source on another domain.

The value uses the REG_DWORD type. 0 allows the access without prompting, 1 asks the user whether to allow it, and 3 blocks it. When the policy is not configured, this access is blocked by default in the Restricted Sites Zone.

Notes

Security

Allowing the action weakens the separation between data sources controlled by different domains. A page in the Restricted Sites Zone can use the supported MSXML or ADO interfaces to retrieve data controlled by another site. If sensitive information is available there in the user's security context, untrusted content may be able to obtain that information.

The setting does not independently bypass authentication, file permissions, or other access controls. It also does not grant a general capability for every kind of cross-domain web request.

Possible side effects

Blocking the action can break legacy web applications that rely on MSXML or ADO for legitimate cross-domain data access. A value of 1 makes each applicable access dependent on the user's response and can therefore cause interruptions or inconsistent outcomes.

Notes

The HKLM key represents the device-scoped policy variant, while the HKCU key represents the user-scoped variant. Zones\4 applies specifically to the Restricted Sites Zone.

Microsoft's policy reference describes the setting first as access to another security zone, but describes its enabled behavior as access to another site within the same zone. Technically, the value represents the cross-domain-data URL action and should not be interpreted as a general permission for all cross-zone or cross-origin access.

This setting belongs to the Internet Explorer security-zone model. It can also affect pages rendered in Microsoft Edge's Internet Explorer mode, which supports Internet Explorer policies governing security zones. It does not control ordinary pages rendered by the Chromium engine in Microsoft Edge.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneAllowAccessToDataSources

Microsoft Learn: URL Policy Flags

Microsoft Learn: What is Internet Explorer mode?

See also

• Entry in the reference