MACROMEDIA FLASH MX 2004-ACTIONSCRIPT LANGUAGE Reference page 849

This causes Flash Player to attempt to retrieve a policy file from the specified host and port. Any
port can be used, not only ports 1024 and higher. Upon establishing a connection with the
specified port, Flash Player transmits
XMLSocket server can be configured to serve both policy files and normal XMLSocket
connections over the same port, in which case the server should wait for
before transmitting a policy file. A server can also be set up to serve policy files over a
request/>
separate port from normal connections, in which case it can send a policy file as soon as a
connection is established on the dedicated policy file port. The server must send a null byte to
terminate a policy file, and may thereafter close the connection; if the server does not close the
connection, Flash Player will do so upon receiving the terminating
A policy file served by an XMLSocket server has the same syntax as any other policy file, except
that it must also specify the ports to which access is granted. When a policy file comes from a port
lower than 1024, it can grant access to any ports; when a policy file comes from port 1024 or
higher, it can grant access only to other ports 1024 and higher. The allowed ports are specified in
a attribute in the
"to-ports"
wildcards are all allowed. The following example shows an XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
A policy file obtained from the old default location—/crossdomain.xml on an HTTP server on
port 80—implicitly authorizes access to all ports 1024 and above. There is no way to retrieve a
policy file to authorize XMLSocket operations from any other location on an HTTP server; any
custom locations for XMLSocket policy files must be on an XMLSocket server.
Because the ability to connect to ports lower than 1024 is new, a policy file loaded with
must always authorize this, even when a movie clip is connecting to its own
loadPolicyFile()
subdomain.
<cross-domain-request/>
<allow-access-from>
, terminated by a
<cross-domain-
byte.
null
tag. Single port numbers, port ranges, and
System.security.loadPolicyFile()
byte. An
null
849