blocking of 3rd party images on cross-domain sites in IE 6

[scorpion]

Does anybody have any advice on how to solve a complex problem involving IE's blocking of 3rd party images?

For example, let's say you have 3 domain names that all redirect to the same location. However, all the images on the site are hardcoded using an absolute URL which differs from the URL from which the surfer came. This causes IE to show the privacy icon and shows virtually every image as "blocked"..of course the page loads fine except for this icon in the status bar

Does one need to specify some privacy files on the server that would allow 'n' domains to be allowed on that page regardless of what domain name the user came from?

[shasan]

if the destination site is SSL, than all the links to images should start with https instead of http.

i.e. <img src="https://www.example.com/images/foobar.gif">

If I get your meaning, then this should fix the problem.

shasan.

[scorpion]

no they are not ssl.

e.g.

<img src="http://www.mysite.com/animage.jpg">

Now if the user comes to the site from ANYTHING but www.mysite.com such as 'mysite.com', 'mysite.net', etc..and all these domains are rewritten in the server config to point to the same location transparently, they will get the lock saying every single image of the above format has been blocked (loads fine though) when they come in from any domain that doesn't match the exact absolute URL of the image. We need to use absolute urls in the img tag as the page is dynamically generated...

See what I mean?

[keyplyr]

My logs tell me that what you describe does not occur at my site.

This leads me to guess that the issue may be with your own security settings in IE, e.g. Tools > Internet Options > Security. Try some tests by changing your Security settings to allow everything and see if this phenomenon still exists.

[wkitty42]

scorpion,

it would seem, then, that it would be better to use relative urls for the image files instead of hardcoding them... either that or redirect everyone to one domain... preferrably the one that the images are hosted on ;) i've always sent folk arriving on example.foo to www.example.foo... and if i have my domain registered in .foo and .bar, i choose one of them as the master if they are to contain the same content and redirect the other one to the master...

[edit] speeling [/edit]

[shasan]

My point was that they NEED to be httpS if they are hosted somewhere else. i.e. if the URL is https and the image is not and on a different server, I believe you will get a security warning.

That's only if the URL is SSL encrypted. If not, then that's a different problem. If you can browse other pages just fine, it might not be your browser settings, although it is a possibility.