IE6 XMLHttpRequest same-origin policy

In IE6, there is no native XMLHttpRequest object, but we can use ActiveXObject('Msxml2.XMLHTTP') for the same purpose. The same-origin policy also applies to ActiveXObject in IE6, and there might be exceptions. There is a setting called "Access data sources across domains" for internet, intranet, and trusted sites zone. If it is set to enable in internet/intranet/trusted sites and the page that tries to access data in different domains falles into one of those zones, you won't get the permission denied exception. If the option is set to false, you will get the exception.