
There are two scenarios where you would use the URL security zone interfaces:
In a few cases, an application might want to manage the default URL security zone settings by using the IInternetZoneManager interface. The changes would not be static, because the user could override any changes by setting the URL security zone options in Internet Explorer 4.0. In most cases, applications that need to control the URL security zone settings should create an application that hosts the WebBrowser control or IE4/MSHTML and implement their own security manager.
Interfaces related to URL security zones
WebBrowser control or IE4/MSHTML hosts could create a security manager (by implementing the IInternetSecurityManager interface) that handles the URL actions and policies that are important to the host. Other URL actions and policies would be passed to the default security manager so it can handle them appropriately. The IInternetSecurityMgrSite interface would be used to handle Windows®-related information from the component so that the customized security manager can handle any user interface it needed.
To create a customized security manager, the component must implement the IInternetSecurityManager interface. Any methods or URL actions that the customized security manager wants the default security manager to act on should return INET_E_DEFAULT_ACTION.
The component must also implement a ClientSite object when embedding either the WebBrowser control or IE4/MSHTML.
The following steps occur for a URL action:
Note The URL security zone API offers support only for a single, customized security manager to delegate URL actions back to the default security manager. If more than one customized security manager is implemented, the additional security managers must explicitly find and invoke the security manager above it to allow multiple delegations to operate correctly.
Components hosted by the WebBrowser control or IE4/MSHTML might need to query the security manager for the URL policies being implemented in the URL security zone they are in. These components include script engines (JScript and VBScript), controls, Java applets, code download, and so on. For example, the code download component of Internet Explorer 4.0 needs to ask the security manager if it can download unsigned ActiveX Controls. The component calls the IInternetHostSecurityManager::ProcessUrlAction method to check what the policy is on Java applets to help make its decision.
To query for URL policies, these components use the IInternetHostSecurityManager interface. The component must also have the address of a site interface implemented by the WebBrowser control or IE4/MSHTML. The exact site interface would depend on the type of component being hosted. For example, a script engine should have the IActiveScriptSite interface implemented, while controls would implement an IOleClientSite interface. To get the address of this interface:
If a custom security manager was implemented by a host application, the default Internet Security Manager would pass the call up to the custom security manager's IInternetSecurityManager interface.
© 1997 Microsoft Corporation. All rights reserved. Terms of Use.