Anytime that I open a web app (uses javascript ESRI code) via window.showModalDialog I get the following error:

enter image description here

Using window.open does not cause any issues.

I have played around with privacy settings and set it to "Block All Cookies", so I shouldn't be even getting this prompt. However, if I remove the site from "Trusted Sites" I do not get the above prompt? I have also set it so that for Internet, Local Intranet, and Trusted sites, are all using the exact same level: Medium. I would presume that if the site is not in trusted sites it should be behaving as if it's from either "Internet" or "Local intranet". But if that is so, why is it behaving differently if they all have the same settings?

Here are my privacy settings:

enter image description here

Update: I noticed that the Privacy tab specifically mentions the Internet zone: Privacy Settings Only Affect Internet Zone. Following some of the linked pages I discovered you can create a file (P3P {Platform for Privacy Preferences}) and import it to IE that will specifically tell IE what rules to apply for cookies for each zone.

I tried creating the following, but I am still prompted for cookies. Why?

<?xml version="1.0" encoding="UTF-8"?>
   <MSIEPrivacySettings formatVersion="6">
      <p3pCookiePolicy zone="trustedSites">
               <firstParty noPolicyDefault="reject" noRuleDefault="reject" alwaysAllowSession="yes">
               <thirdParty noPolicyDefault="reject" noRuleDefault="reject" alwaysAllowSession="yes" />
      <p3pCookiePolicy zone="internet">
               <firstParty noPolicyDefault="reject" noRuleDefault="reject" alwaysAllowSession="yes">
               <thirdParty noPolicyDefault="reject" noRuleDefault="reject" alwaysAllowSession="yes" />
      <alwaysReplayLegacy />
   <MSIESiteRules formatVersion="6">
      <site domain="host2.erportalhost.com" action="reject" />
      <site domain="sampleserver6.arcgisonline.com" action="reject" />
      <site domain="js.arcgis.com" action="reject" />

migrated from security.stackexchange.com Apr 16 '15 at 12:13

This question came from our site for information security professionals.

  • Although this is a privacy question, it might be a better fit over at SuperUser? It's highly specific to the internal workings of Windows. – schroeder Apr 15 '15 at 20:47

I was finally able to solve the issue. I was able to solve the issue by moving our site from the Trusted sites zone to the Intranet zone.

The reason this works is because the Intranet zone by default will accept all cookies. Internet zone cookie settings are determined by the Privacy tab, Trusted sites zone by default prompts for all cookies, Restricted zone blocks all cookies. There is an option to override these settings by importing a P3P xml file into IE, but that seemed to be unsuccessful , so I think we will just have to live with having the site in the Intranet zone. This will obviously have to be done for each users machine. I already did for the Server machine, as the desktop you set up for us didn’t seem to be up and running. This might require that the settings for Trusted Sites have to also be set for the Intranet zone, but since it’s working for the server machine I assume that all the other desktop user machines are also using those settings for the Intranet zone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.