title: AJAX from HTTP to HTTPS
body: <p>On my page I have the FORM with one INPUT field. On SUBMIT this form I use JavaSript function "test_kod(this)" to valid is the the entered value correct or not. But in the Internet Explorer ver &lt;=9 the OPEN method always fall with error "access denied". 
  WHAT AM I DOING WRONG? 
  P.S. Because of some limitations I cant use JQUERY.</p>
  
  <pre><code>function test_kod(field) {
    var req = createXMLHTTPObject();
    if (!req) { 
      return false;
    };
    try {
    //in IE &lt;= 9 in this place debuger always return error "access denied" 
    req.open("GET","https://dad-atlas.datasolutions.pl/karta.php?karta="+field.value,false);
    }
    catch(e){
      return false;
    }
    req.setRequestHeader('User-Agent','XMLHTTP/1.0');
    req.onreadystatechange = function () {
      if (req.readyState != 4) return;
      if (req.status != 200 &amp;&amp; req.status != 304) {
        return false;
      }
      if (req.responseText == "TAK") {
        return true;
      } else {
        return false;
      };
    }
    if (req.readyState == 4) return;
    req.send();
  }
  
  var XMLHttpFactories = [
  function () {return new XMLHttpRequest()},
  function () {return new ActiveXObject("Msxml2.XMLHTTP")},
  function () {return new ActiveXObject("Msxml3.XMLHTTP")},
  function () {return new ActiveXObject("Microsoft.XMLHTTP")}
  ];
  
  function createXMLHTTPObject() {
  var xmlhttp = false;
  for (var i=0;i&lt;XMLHttpFactories.length;i++) {
  try {
  xmlhttp = XMLHttpFactories[i]();
  }
  catch (e) {
  continue;
  }
  break;
  }
  return xmlhttp;
  }
  </code></pre>
  
  <h2>EDIT</h2>
  
  <p>I digged in the NET and changed my script to use the XDomainRequest. It works good, but only if the url request has <strong>HTTP</strong> protocol. When I try to use url request with <strong>HTTPS</strong> protocol, in IE I still have the "access denied" error.</p>
  
  <p>My new script.</p>
  
  <pre><code>function test_kod(field) {
    var xhr = createCORSRequest('GET', "https://dad-atlas.datasolutions.pl/karta.php?karta="+field.value);
    //var xhr = createCORSRequest('GET', "http://facebook.com");
    if (!xhr) {
      alert('CORS not supported');
      return false;
    }
    // Response handlers.
    xhr.onload = function() {
      var text = xhr.responseText;
      var title = getTitle(text);
      alert('Response from CORS request to ' + url + ': ' + title);
    };
  
    xhr.onerror = function() {
      alert('Woops, there was an error making the request.');
    };
  
    xhr.send();
  }
  
  // Create the XHR object.
  function createCORSRequest(method, url) {
    var xhr = new XMLHttpRequest();
    if ("withCredentials" in xhr) {
      // XHR for Chrome/Firefox/Opera/Safari.
      xhr.open(method, url, true);
      alert("Firefox open");
    } else if (typeof XDomainRequest != "undefined") {
      // XDomainRequest for IE.
      xhr = new XDomainRequest();
      xhr.open(method, url);
      alert("IE open");
    } else {
      alert('CORS not supported');
      xhr = null;
    }
    return xhr;
  }
  
  // Helper method to parse the title tag from the response.
  function getTitle(text) {
    return text.match('&lt;title&gt;(.*)?&lt;/title&gt;')[1];
  }
  </code></pre>