Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 5 down vote favorite

My website is recording a lot of 404 errors, from numerous sources, for a file crossdomain.xml. Does anyone know what this file is or why it's being requested?

share|improve this question

3 Answers

up vote 6 down vote accepted

Correct, the crossdomain.xml file is requested to determine if Flash and Silverlight apps are "allowed" to access your website. Personally, I think it's a really dumb convention, but.. it's out there.

For Microsoft Silverlight

When calling a cross-domain service, Silverlight will check for the existence of clientaccesspolicy.xml first. This is the format defined by Silverlight and provides a pretty flexible way to define who can access what services. If not found, it will then default to look for crossdomain.xml, which is the file format implemented for Adobe Flash. It is important to note that this file will also still work for most public web services.

For Adobe Flash

Another change to the Flash Player 7 framework is the use of cross-domain policy files. A policy file is a simple XML file that gives the Flash Player permission to access data from a given domain without displaying a security dialog. When placed on a server, it tells the Flash Player to allow direct access to data on that server, without prompting the user to grant access.

Probably easiest to add this file if you don't want the 404s, and decide whether or not you want to allow Flash and Silverlight access to your website without a security prompt.

share|improve this answer
Why is the convention dumb? A unified standard should be established (for both browsers and all RIA platforms), but having some way to define cross-domain request policies itself is a good idea. It gives developers more freedom while still protecting against XSRF attacks. And using an XML file to define policies seems easier to deploy than CORS. – Lèse majesté Dec 19 '10 at 9:23
thankyou, your response was very helpful! – Nathan Ridley Dec 19 '10 at 23:28
up vote 1 down vote

This file contains permissions for flash applications. It is requested by any flash app embedded on your site. (Just like favicon or robots.txt)

share|improve this answer
Ah cool, so I should just stick that file in my root directory to make the 404 errors go away? – Nathan Ridley Dec 19 '10 at 0:25
up vote 0 down vote

This file is requested any time a remote website script attempts to get resources from your site. See this question.
So, this means, someone is trying to leech your files - read referrers, if they are logged.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.