MACROMEDIA FLASH 8-LEARNING ACTIONSCRIPT 2.0 IN FLASH Manual page 706

In this example, Flash Player tries to retrieve a policy file from the specified host and a port.
Any port can be used if the policy file is not in the default (root) directory; otherwise the port
is limited to 1024 and higher (as with earlier players). When a connection is established to the
specified port, Flash Player sends
The XML socket server might be configured to serve policy files in the following ways:
To serve policy files and normal socket connections over the same port. The server should
wait for
<policy-file-request />
To serve policy files over a separate port from normal connections, in which case it might
send a policy file as soon as a connection is established on the dedicated policy file port.
The server must send a null byte to terminate a policy file before it closes the connection. If
the server does not close the connection, Flash Player does so upon receiving the terminating
null byte.
A policy file served by an XML socket server has the same syntax as any other policy file,
except that it must also specify the ports to which access is granted. The allowed ports are
specified in a
to-ports
port 1024, it can grant access to any port; when a policy file comes from port 1024 or higher,
it can grant access only to other ports above 1024. Single port numbers, port ranges, and
wildcards are allowed. The following code is an example of an XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
Because the ability to connect to ports lower than 1024 is available in Flash Player 7
(7.0.19.0) and later, a policy file loaded with
this, even when a SWF file is connecting to its own subdomain.
706 Understanding Security
<policy-file-request />
before transmitting a policy file.
attribute in the
<allow-access-from>
loadPolicyFile
, terminated by a null byte.
tag. If a policy file is less than
is always required to authorize