Handling URL Security Zones

Handling URL Security Zones


There are two scenarios where you would use the URL security zone interfaces:

In a few cases, an application might want to manage the default URL security zone settings by using the IInternetZoneManager interface. The changes would not be static, because the user could override any changes by setting the URL security zone options in Internet Explorer 4.0. In most cases, applications that need to control the URL security zone settings should create an application that hosts the WebBrowser control or IE4/MSHTML and implement their own security manager.

Interfaces related to URL security zones

Applications Hosting the WebBrowser Control or IE4/MSHTML

WebBrowser control or IE4/MSHTML hosts could create a security manager (by implementing the IInternetSecurityManager interface) that handles the URL actions and policies that are important to the host. Other URL actions and policies would be passed to the default security manager so it can handle them appropriately. The IInternetSecurityMgrSite interface would be used to handle Windows®-related information from the component so that the customized security manager can handle any user interface it needed.

To create a customized security manager, the component must implement the IInternetSecurityManager interface. Any methods or URL actions that the customized security manager wants the default security manager to act on should return INET_E_DEFAULT_ACTION.

The component must also implement a ClientSite object when embedding either the WebBrowser control or IE4/MSHTML.

The following steps occur for a URL action:

  1. IE4/MSHTML uses CoCreateInstance to create an instance of the Internet Security Manager.

    Creating an instance of the security manager

  2. The Internet Security Manager calls QueryInterface method on the IE4/MSHTML to get its IServiceProvider interface. The IE4/MSHTML then calls the QueryInterface method on the IOleClientSite interface to get the IServiceProvider interface.

    Finding the IServiceProvider interface

  3. IServiceProvider::QueryService is called to get an IInternetSecurityManager interface. The component then passes a pointer to its implementation of IInternetSecurityManager to the Internet Security Manager.

    Getting a reference to the custom security manager

  4. Calls from IE4/MSHTML to the IInternetSecurityManager methods are passed to the custom security manager from the default Internet Security Manager.

    Passing a call to the custom security manager

  5. If the method called returns INET_E_DEFAULT_ACTION, the default implementation of IInternetSecurityManager is used to resolve the call. Otherwise the result from the custom security manager is returned.

    Returning back to the default security manager

  6. The Internet Security Manager returns the result back to the IE4/MSHTML.

    Returning back to the IE4/MSHTML

Note The URL security zone API offers support only for a single, customized security manager to delegate URL actions back to the default security manager. If more than one customized security manager is implemented, the additional security managers must explicitly find and invoke the security manager above it to allow multiple delegations to operate correctly.

Components Hosted by IE4/MSHTML

Components hosted by the WebBrowser control or IE4/MSHTML might need to query the security manager for the URL policies being implemented in the URL security zone they are in. These components include script engines (JScript and VBScript), controls, Java applets, code download, and so on. For example, the code download component of Internet Explorer 4.0 needs to ask the security manager if it can download unsigned ActiveX™ Controls. The component calls the IInternetHostSecurityManager::ProcessUrlAction method to check what the policy is on Java applets to help make its decision.

To query for URL policies, these components use the IInternetHostSecurityManager interface. The component must also have the address of a site interface implemented by the WebBrowser control or IE4/MSHTML. The exact site interface would depend on the type of component being hosted. For example, a script engine should have the IActiveScriptSite interface implemented, while controls would implement an IOleClientSite interface. To get the address of this interface:

  1. The component calls the QueryInterface method on the site interface to get the IServiceProvider interface. The component then calls IServiceProvider::QueryService to get the IInternetHostSecurityManager interface.

    Accessing the host security manager

  2. The component calls the IInternetHostSecurityManager methods. The host security manager creates an instance of the Internet Security Manager. The host security manager then adds the URL and calls the associated method on the IInternetSecurityManager interface.

    Getting security zone information

    If a custom security manager was implemented by a host application, the default Internet Security Manager would pass the call up to the custom security manager's IInternetSecurityManager interface.

  3. The IInternetSecurityManager method would return its results to the IInternetHostSecurityManager. The IInternetHostSecurityManager would then pass the results to the component.

    Returning results back from the security manager

© 1997 Microsoft Corporation. All rights reserved. Terms of Use.