User Guide

System.security.loadPolicyFile() 849
This causes Flash Player to attempt to retrieve a policy file from the specified host and port. Any
port can be used, not only ports 1024 and higher. Upon establishing a connection with the
specified port, Flash Player transmits
<cross-domain-request/>, terminated by a null byte. An
XMLSocket server can be configured to serve both policy files and normal XMLSocket
connections over the same port, in which case the server should wait for
<cross-domain-
request/>
before transmitting a policy file. A server can also be set up to serve policy files over a
separate port from normal connections, in which case it can send a policy file as soon as a
connection is established on the dedicated policy file port. The server must send a null byte to
terminate a policy file, and may thereafter close the connection; if the server does not close the
connection, Flash Player will do so upon receiving the terminating
null byte.
A policy file served by an XMLSocket server has the same syntax as any other policy file, except
that it must also specify the ports to which access is granted. When a policy file comes from a port
lower than 1024, it can grant access to any ports; when a policy file comes from port 1024 or
higher, it can grant access only to other ports 1024 and higher. The allowed ports are specified in
a
"to-ports" attribute in the <allow-access-from> tag. Single port numbers, port ranges, and
wildcards are all allowed. The following example shows an XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
A policy file obtained from the old default location—/crossdomain.xml on an HTTP server on
port 80—implicitly authorizes access to all ports 1024 and above. There is no way to retrieve a
policy file to authorize XMLSocket operations from any other location on an HTTP server; any
custom locations for XMLSocket policy files must be on an XMLSocket server.
Because the ability to connect to ports lower than 1024 is new, a policy file loaded with
loadPolicyFile() must always authorize this, even when a movie clip is connecting to its own
subdomain.