MACROMEDIA FLASH 8-ACTIONSCRIPT 2.0 LANGUAGE Reference page 1066

You can use
loadPolicyFile()
request that requires a policy file, Flash Player always waits for the completion of any policy
file downloads before denying a request. As a final fallback, if no policy file specified with
authorizes a request, Flash Player consults the original default location, /
loadPolicyFile()
crossdomain.xml.
Using the
xmlsocket
directly from an XMLSocket server, as shown in the following example:
System.security.loadPolicyFile("xmlsocket://foo.com:414");
This causes Flash Player to attempt to retrieve a policy file from the specified host and port.
Any port can be used, not only ports 1024 and higher. Upon establishing a connection with
the specified port, Flash Player transmits
byte. An XMLSocket server can be configured to serve both policy files and normal
XMLSocket connections over the same port, in which case the server should wait for
<policy-file-request />
serve policy files over a separate port from standard connections, in which case it can send a
policy file as soon as a connection is established on the dedicated policy file port. The server
must send a null byte to terminate a policy file, and may thereafter close the connection; if the
server does not close the connection, Flash Player does so upon receiving the terminating
byte.
null
A policy file served by an XMLSocket server has the same syntax as any other policy file,
except that it must also specify the ports to which access is granted. When a policy file comes
from a port lower than 1024, it can grant access to any ports; when a policy file comes from
port 1024 or higher, it can grant access only to other ports 1024 and higher. The allowed
ports are specified in a
numbers, port ranges, and wildcards are all allowed. The following example shows an
XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
A policy file obtained from the old default location--/crossdomain.xml on an HTTP server on
port 80—implicitly authorizes access to all ports 1024 and above. There is no way to retrieve
a policy file to authorize XMLSocket operations from any other location on an HTTP server;
any custom locations for XMLSocket policy files must be on an XMLSocket server.
1066 ActionScript classes
to load any number of policy files. When considering a
protocol along with a specific port number, lets you retrieve policy files
<policy-file-request />
before transmitting a policy file. A server can also be set up to
attribute in the
"to-ports"
, terminated by a
<allow-access-from>
null
tag. Single port