MACROMEDIA FLEX-FLEX ACTIONSCRIPT LANGUAGE, Reference

Page: 444 / 830

444 Chapter 6: ActionScript Core Classes
A policy file served by an XMLSocket server has the same syntax as any other policy file, except
that it must also specify the ports to which access is granted. When a policy file comes from a port
lower than 1024, it can grant access to any ports; when a policy file comes from port 1024 or
higher, it can grant access only to other ports 1024 and higher. The allowed ports are specified in
a
"to-ports"
attribute in the
<allow-access-from>
tag. Single port numbers, port ranges, and
wildcards are all allowed. The following example shows an XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
A policy file obtained from the old default location—/crossdomain.xml on an HTTP server on
port 80—implicitly authorizes access to all ports 1024 and above. There is no way to retrieve a
policy file to authorize XMLSocket operations from any other location on an HTTP server; any
custom locations for XMLSocket policy files must be on an XMLSocket server.
Because the ability to connect to ports lower than 1024 is new, a policy file loaded with
loadPolicyFile()
must always authorize this, even when a movie clip is connecting to its own
subdomain.