4

I've noticed that I get this string of errors in IE in my SharePoint Online sites.

SEC7111: HTTPS security is compromised by res://ieframe.dll/forbidframing.htm
SEC7111: HTTPS security is compromised by res://ieframe.dll/ErrorPageTemplate.css
SEC7111: HTTPS security is compromised by res://ieframe.dll/errorPageStrings.js
SEC7111: HTTPS security is compromised by res://ieframe.dll/httpErrorPagesScripts.js
SEC7111: HTTPS security is compromised by res://ieframe.dll/red_x.png
SEC7111: HTTPS security is compromised by res://ieframe.dll/bullet.png
SEC7111: HTTPS security is compromised by res://ieframe.dll/background_gradient.jpg

Anyone know what causes this and/or how to fix?

I've seen similar posts in SO not related to SharePoint, but always get the same ones in my SP sites (compared to other files in other sites) so thought it might be worth a post here.

I have tried some of the solutions I have found, but haven't had any luck. I thought the most likely case would be something to do with Internet Security Options like this post mentions: https://stackoverflow.com/questions/11430904/ie9-res-ieframe-dll-error. I didn't have any luck with the answer there though.

  • I have the same problem (also just noticed). An additional problem seems to be that my search pages are showing results when the page is not published (check-in/check-out mode) but when being published nothing is shown - not even an error. – user50269 Jan 14 '16 at 9:52
  • I've seen these exact errors in my environments, and only in IE. It has to be a platform bug. – Derek Gusoff Mar 2 '16 at 16:16
2

My 100% uncustomized OOB Team Site shows all those too.

I've opened /_layouts/15/viewlsts.aspx page, set up Fiddler and it seems this one response from login.live.com is causing the described error being logged: enter image description here

Response has X-Frame-Options: deny header. Citing a post at IEInternals:

If the X-FRAME-OPTIONS value contains the token DENY, browsers will prevent the page from rendering if it will be contained within a frame. For instance, if http://shop.example.com/confirm.asp contains a DENY directive, that page will not render in a subframe, no matter where the parent frame is located.

If the value contains the token SAMEORIGIN, the browser will block rendering only if the origin of the top-level browsing-context is different than the origin of the content containing the X-FRAME-OPTIONS directive. For instance, if http://shop.example.com/confirm.asp contains the X-FRAME-OPTIONS directive with the SAMEORIGIN token, the page may be framed by any page from the exact http://shop.example.com origin.

That header forces Internet Explorer to show this if login.live.com/login... is requested in subframe (and that makes sense, actually):

enter image description here

It seems all we can do is ignore those errors. I have no idea why login.live.com / outlook.com is even involved in O365.


UPDATE: I don't see this requests to live.com under other account in other organization. My first account email address has also a Microsoft Account associated with it, and I'm logged in Windows 10 under that Microsoft Account. That could be related. Could someone test this hypothesis?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.