MACROMEDIA FLASH 8-LEARNING ACTIONSCRIPT 2.0 IN FLASH - Page 706

706 Understanding Security
In this example, Flash Player tries to retrieve a policy file from the specified host and a port.
Any port can be used if the policy file is not in the default (root) directory; otherwise the port
is limited to 1024 and higher (as with earlier players). When a connection is established to the
specified port, Flash Player sends
<policy-file-request />, terminated by a null byte.
The XML socket server might be configured to serve policy files in the following ways:
■ To serve policy files and normal socket connections over the same port. The server should
wait for
<policy-file-request /> before transmitting a policy file.
■ To serve policy files over a separate port from normal connections, in which case it might
send a policy file as soon as a connection is established on the dedicated policy file port.
The server must send a null byte to terminate a policy file before it closes the connection. If
the server does not close the connection, Flash Player does so upon receiving the terminating
null byte.
A policy file served by an XML socket server has the same syntax as any other policy file,
except that it must also specify the ports to which access is granted. The allowed ports are
specified in a
to-ports attribute in the <allow-access-from> tag. If a policy file is less than
port 1024, it can grant access to any port; when a policy file comes from port 1024 or higher,
it can grant access only to other ports above 1024. Single port numbers, port ranges, and
wildcards are allowed. The following code is an example of an XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
Because the ability to connect to ports lower than 1024 is available in Flash Player 7
(7.0.19.0) and later, a policy file loaded with
loadPolicyFile is always required to authorize
this, even when a SWF file is connecting to its own subdomain.