MACROMEDIA FLASH 8-LEARNING ACTIONSCRIPT 2.0 IN FLASH Manual page 704

If the SWF file you are downloading comes from an HTTPS server, but the SWF file loading
it is on an HTTP server, you need to add the
tag, as shown in the following code:
access-from>
<allow-access-from domain="www.foo.com" secure="false" />
A policy file that contains no
policy on a server.
About custom policy file locations
Flash Player 7 (7.0.19.0) supports a method called
This method lets you specify a custom location on a server where a cross-domain policy file
can be found, so it does not need to be in the root directory. Flash Player 7 (7.0.14.0) only
searched for policy files in the root location of a server, but it can be inconvenient for a site
administrator to place this file in the root directory. For more information on the
method and XMLSocket connections, see
loadPolicyFile
on page 705 and
loadPolicyFile (security.loadPolicyFile method)
ActionScript 2.0 Language Reference.
If you use the
loadPolicyFile
directory, as long as the SWF files that need to use the policy file call
Flash Player where the policy file is located. However, policy files not placed in the root
directory have a limited scope. The policy file allows access only to locations at or below its
own level in the server's hierarchy.
The
loadPolicyFile
of SWF files using the
Require Flash Player 7 (7.0.19.0) or later.
Arrange for the site where the data is coming from to have a policy file in the default
location (the root directory) as well as in the nondefault location. Earlier versions of Flash
Player use the default location.
Otherwise, authors must create SWF files so a failure of a cross-domain loading operation is
implemented.
If your SWF file relies on
Player 7 (7.0.19.0) or later do not have problems. However, visitors with Flash Player 7
(7.0.14.0) do not have support for
704 Understanding Security
<allow-access-from>
method, a site administrator can place the policy file in any
method is available only in Flash Player 7 (7.0.19.0) or later. Authors
method must do one of the following:
loadPolicyFile
loadPolicyFile
loadPolicyFile
attribute to the
secure="false"
tags has the same effect as not having a
System.security.loadPolicyFile
"About XMLSocket policy files"
, visitors with Flash Player 6 or earlier or Flash
.
<allow-
.
in the
to tell
loadPolicyFile