Fixing your CrossDomain.xml File

I was working on the next episode of The Flex Show's Fifteen Minutes With Flex and came across an issue I thought was worthy of a blog post.

The episode will talk about XML and as an example I was writing some Flex code to grab the RSS feed from the Flex Show. This was giving me a run time warning in the debugging console. This was the error:


Warning: Domain www.theflexshow.com does not specify a meta-policy. Applying default meta-policy 'all'. This configuration is deprecated. See http://www.adobe.com/go/strict_policy_files to fix this problem.

This was my file:


<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

I brought up the Adobe Dev center article and read through it. Unfortunately, this was full of background and reasoning and I could not find an easy fix. On page 2 of the article, I found a link to the xsd definition. I parsed through it using my developer brain and was able to cobble together a solution. I added two tags to the crossdomain.xml file, site-control and allow-http-request-headers-from. This removed the debugger warning. Here is the final file:


<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <site-control permitted-cross-domain-policies="all" />
    <allow-access-from domain="*" />
    <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

Back to work!

Comments (Comment Moderation is enabled. Your comment will not appear until approved.)
Matthew Platte's Gravatar Thanks so much for doing the heavy lifting. I, too, started to read the Adobe Dev Center article -- but I fell asleep waiting for them to get to the point.
# Posted By Matthew Platte | 8/12/08 11:40 AM
Jason The Saj's Gravatar Dear Flex Show,

I've tried subscribing to the video shows and loading them on my iPhone. But get an error. Been to busy to research into it. But just wanted to check with you as to whether the video podcast was iPod/iPhone compatible.
# Posted By Jason The Saj | 8/12/08 11:49 AM
Jeffry Houser's Gravatar Matthew,

The URL in the warning really should go to a KB article which includes a sample file. Not a 6+ page dissertation. I had the same problems with the article as you.

Glad to have helped!
# Posted By Jeffry Houser | 8/12/08 11:49 AM
Bryan Bartow's Gravatar Thanks for posting this. I thought I was the only one that couldn't get through the Tome of Crossdomain on adobe.com without wanting to gouge my eyes out.
# Posted By Bryan Bartow | 8/12/08 10:55 PM
Billigflug's Gravatar Lol Methew, you hit the mark. That's exactly what I experienced by reading the article.
# Posted By Billigflug | 11/14/08 10:00 AM
Tomas Sancio's Gravatar I'm still stuck with policy files and as outlined the Adobe article, my priorities are the following:
1. Immediately: fix the bug that's not allowing me to connect to load data from the server using HTTPService no matter how many times I feed the crossdomain.xml file.
2. Immediately: get an overview of Flash security and
3. As time permits: understand why I made a fool out of myself in a presentation when I used "Export Release Build" for a demo that I thought would have worked easily with the debugger.
# Posted By Tomas Sancio | 5/31/09 11:51 PM
All Content Copyright 2005, 2006, 2007, 2008, 2009 Jeffry Houser. May not be reused without permission
BlogCFC was created by Raymond Camden. This blog is running version 5.9.2.002.