Flex and crossdomain.xml

Question

I was wondering are there any security concerns with adding crossdomain.xml to the root of an application server? Can it be added to any other parts of the server and are you aware of any work arounds that dont require the server to have this file in place?

Thanks Damien

Answer 1

By adding the crossdomain.xml, the main security concern is that flash applications can now connect to your server. So if someone logs into your site, and then browses over to another website with a malicious flash app, that flash app can connect back to your site. Since it's in a browser, cookies are shared to the flash app. This allows the flash app to hijack the user's session to do whatever it is your website does without the user knowing about it.

If your flex app is served from the same server, you don't need a crossdomain.xml

You can put it in a sub directory of your site and use System.security.loadSecurityPolicy()

http://livedocs.adobe.com/flex/2/langref/flash/system/Security.html

Applications would then be limited to that tree of your directory structure.

Answer 2

There are no workaround for the crossdomain file, it is required to support the crossdomain data access or crossdomain scripting. In the event of any cross-domain request, Flash will look for the crossdomain.xml file at the root of the domain. For example, if you are requesting an XML file from:

http://mysubdomain.mydomain.com/fu/bar/

Flash will check if a crossdomain.xml file exist at:

http://mysubdomin.mydomain.com/crossdomain.xml

You can place the crossdomain.xml file in other location. However, when you ever need to load a crossdomain.xml file from a different location, you have to do it via Security.loadPolicyFile . Bear in mind that the location of this crossdomain have any impact on the security access you have. Flash will only grant access to the folder that contains the crossdomain and its child folders.

You may also want to read up on the security changes in Flash Player 10.

Answer 3

You may configure a virtual host for your application. This way the file crossdomain.xml can be at the root of your application but not necessarily at the root of the server.

Answer 4

Yes. Be very careful with crossdomain policy files:
http://www.jamesward.com/2009/11/08/how-bad-crossdomain-policies-expose-protected-data-to-malicious-applications/

My two general rules of thumb are:

• Do not put a crossdomain policy file on a server that uses cookies
• Do not put a crossdomain policy file on an internal server

Answer 5

crossdomain.xml is just a file that has meaning to the Flash runtime; you can restrict what HTTP requests get to see it. You can use web server (e.g. Apache) configuration control to allow read access to it (and only it) from the "root" directory (see previous answers).

You might filter by other headers in the request, etc.

Cheers