My website is recording a lot of 404 errors, from numerous sources, for a file crossdomain.xml. Does anyone know what this file is or why it's being requested?


Correct, the crossdomain.xml file is requested to determine if Flash and Silverlight apps are "allowed" to access your website. Personally, I think it's a really dumb convention, but.. it's out there.

For Microsoft Silverlight

When calling a cross-domain service, Silverlight will check for the existence of clientaccesspolicy.xml first. This is the format defined by Silverlight and provides a pretty flexible way to define who can access what services. If not found, it will then default to look for crossdomain.xml, which is the file format implemented for Adobe Flash. It is important to note that this file will also still work for most public web services.

For Adobe Flash

Another change to the Flash Player 7 framework is the use of cross-domain policy files. A policy file is a simple XML file that gives the Flash Player permission to access data from a given domain without displaying a security dialog. When placed on a server, it tells the Flash Player to allow direct access to data on that server, without prompting the user to grant access.

Probably easiest to add this file if you don't want the 404s, and decide whether or not you want to allow Flash and Silverlight access to your website without a security prompt.

| improve this answer | |
  • Why is the convention dumb? A unified standard should be established (for both browsers and all RIA platforms), but having some way to define cross-domain request policies itself is a good idea. It gives developers more freedom while still protecting against XSRF attacks. And using an XML file to define policies seems easier to deploy than CORS. – Lèse majesté Dec 19 '10 at 9:23

This file contains permissions for flash applications. It is requested by any flash app embedded on your site. (Just like favicon or robots.txt)

| improve this answer | |
  • Ah cool, so I should just stick that file in my root directory to make the 404 errors go away? – Nathan Ridley Dec 19 '10 at 0:25

This file is requested any time a remote website script attempts to get resources from your site. See this question.
So, this means, someone is trying to leech your files - read referrers, if they are logged.

| improve this answer | |
  • The question linked to 404s here, would it be possible to fix? – Will Lanni Apr 19 '19 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.