Microsoft Edge blocked cross-domain requests sent to IPs in same private network CIDR

Question

$.ajax({
    url: "http://10.13.22.150/req_path",
    success: function(result){
        console.log(result);
    }
});

I'd like to send Cross-Domain XMLHttpRequest to ip addresses in the private network. However, the following error is shown in developer tools console:

SCRIPT7002: XMLHttpRequest: Network Error 0x2efd, Could not complete the operation due to error 00002efd.

According to Wireshark, the packet is not sent from client side. I guess the request is blocked by Microsoft Edge Furthermore, I found that the requests are only blocked if the url of XMLHttpRequest and Edge client are in the same CIDR of private network.

Client IP             Request URL            Result
192.168.x.x  send to  192.168.x.x   ->>>>>   X
10.13.x.x    send to  10.13.x.x     ->>>>>   X
10.13.x.x    send to  192.168.x.x   ->>>>>   O

Other browsers like IE11 / Chrome / Firefox work just fine. This circumstance is only shown in Microsoft Edge. Is there any workaround or solution about this issue?

Answer 1

From Understanding Enhanced Protected Mode

Private Network resources

Because EPM does not declare the privateNetworkClientServer capability, your Intranet resources are protected from many types of cross-zone attacks (usually called “Cross-Site-Request-Forgery (CSRF)” and “Intranet Port Scanning.”) Internet pages are not able to frame Intranet pages, load images or resources from them, send them CORS XHR requests, etc.

All of the above seems to apply to MS Edge. The only thing Edge is lacking (at least at this point, v20.10240) is the security zone settings.

My issue wasn't with the XMLHttpRequest but rather with trying to load an intranet page in an iframe inside the internet page. The workaround involved chanding my network setup - see https://stackoverflow.com/a/32828629