<
allow
-
access
-
from domain
=
"105.216.0.40"
/>
7.2.11 Header-based permissions
The following shows how to allow any requesting domain to send the
SOAPAction
header to this target
domain.
allow-http-request-headers-from: Header usage with SOAPAction
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from
domain="*"
headers="SOAPAction"
/>
</cross-domain-policy>
The following allows the Authorization header and any header beginning with the characters X-Foo from
www.example.com to be sent to this target domain. If a request is coming from foo.example.com, only
headers beginning with the characters X-Foo are allowed, not Authorization:
allow-http-request-headers-from: Header usage with wildcard
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-http-request-headers-from
domain="www.example.com"
headers="Authorization,X-Foo*"
/>
<allow-http-request-headers-from
domain="foo.example.com"
headers="X-Foo*"
/>
</cross-domain-policy>
7.3 Certificate-based permissions
Acrobat and Adobe Reader 9.1 introduces an extension to cross-domain policies that enables cross
domain access on a per document basis. You do so by identifying a certified document signed with a
specific certificate that should be able to access web servers in another domain. Since these documents
contain an embedded and unique public key certificate, a SHA-1 hash of the certificate can be used as an
identifier, much like a fingerprint. The fingerprint is extracted from the document and placed in the
crossdomain.xml file, thereby providing access.
Two types of certificate fingerprints are supported:
• Certificates extracted from a certified document. The signature must be valid. Documents signed
with approval (sometimes called "ordinary") signatures are not supported.
• The certificate associated with the digital ID provided to the LiveCycle ES administrator so that the
server can Reader enable documents and provide it with additional usage rights.
Note
The signature must be valid and the certificate must be trusted.
7.3.1 Certified documents
There are several methods for finding the certificate hash. At a high level, the steps involve opening the
certificate in the Certificate Viewer and copying the
Value
data for the SHA1 digest field.
Section 7 Cross Domain Configuration
Application Security Guide
Page 60
Section 7 Cross Domain Configuration
