{"id":1333,"date":"2008-09-29T12:07:51","date_gmt":"2008-09-29T12:07:51","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/cesardelatorre\/2008\/09\/29\/using-silverlight-2-0-clientaccesspolicy-xml-vs-crossdomain-xml-for-web-service-cross-domain-access\/"},"modified":"2008-09-29T12:07:51","modified_gmt":"2008-09-29T12:07:51","slug":"using-silverlight-2-0-clientaccesspolicy-xml-vs-crossdomain-xml-for-web-service-cross-domain-access","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/using-silverlight-2-0-clientaccesspolicy-xml-vs-crossdomain-xml-for-web-service-cross-domain-access\/","title":{"rendered":"Using Silverlight 2.0 clientaccesspolicy.xml vs. crossdomain.xml for Web-Service cross-domain access"},"content":{"rendered":"<\/p>\n

To enable a Silverlight control to access a web service (like a WCF Service) in another domain, the service must explicitly allow cross-domain access. Doing so, a service states that the operations it exposes can safely be invoked by a Silverlight control, without potentially damaging consequences to the data the service stores.<\/p>\n

Silverlight supports two different mechanisms for services to opt-in to cross-domain access:
•    Place a clientaccesspolicy.xml file at the root of the domain where the service is hosted to configure the service to allow cross-domain-access.
•    Place a valid crossdomain.xml file at the root of the domain where the service is hosted. Silverlight supports a subset of the crossdomain.xml schema. This file format is supported as well by ADOBE FLASH (originally by them).<\/p>\n

 <\/p>\n

The question many developers could ask is, ok, which format\/file do I use?.<\/strong><\/p>\n

Well, even though crossdomain.xml is supported by ADOBE FLASH, as well, there is a limitation in current SL20 Beta2 version: If you use crossdomain.xml, the file must mark the entire domain public. I mean, the file must be configured to allow access to the web service from any other domain, or it is not recognized by Silverlight… (Keep in mind that this is a Silverlight’s limitation, probably by design).<\/p>\n

You should configure crossdomain.xml like that:<\/p>\n\n\n\n
\n
<?xml version="1.0"?>\n<!DOCTYPE cross-domain-policy SYSTEM "http:\/\/www.macromedia.com\/xml\/dtds\/cross-domain-policy.dtd">\n<cross-domain-policy>\n  <allow-http-request-headers-from domain="*"<\/strong> headers="*"\/>\n<\/cross-domain-policy><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
So, because of that, I’d always use clientaccesspolicy.xml which allows me to specify all domains OR just specific domains, like the following:<\/strong><\/p>\n\n\n\n
\n
<?xml version="1.0" encoding="utf-8"?>\n<access-policy>\n  <cross-domain-access>\n    <policy>\n      <allow-from http-request-headers="*">\n        <domain uri="http:\/\/contoso.com"\/><\/strong>\n      <\/allow-from>\n      <grant-to>\n        <resource path="\/" include-subpaths="true"\/>\n      <\/grant-to>\n    <\/policy>\n  <\/cross-domain-access>\n<\/access-policy><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
btw, you could always use both files within your Web-Service, so then, Silverlight client apps would check first clientaccesspolicy.xml and apply specific restrictions based on specific domains, no matter what crossdomain.xml says.<\/p>\n
Of course, crossdomain.xml will be used by FLASH client apps.<\/p>\n
So this is the answer!: "Use both files (if you want Flash support for your web-service), but apply specific restrictions into clientaccesspolicy.xml" for Silverlight client apps".<\/strong><\/p>\n
Here you can see the Silverlight’s Cross Domain Policy Flow:<\/p>\n
\"image\"<\/a> <\/p>\n
 <\/p>\n
Remember!, Always save the clientaccesspolicy.xml  or the crossdomain.xml file into the root of the domain\/web-site where the service is hosted. If, for example, the service is hosted in http:\/\/www.mycompany.com<\/a> then the file must be located at http:\/\/www.mycompany.com\/crossdomain.xml<\/a>. You cannot put it within your App’s Virtual Directory<\/u>, like http:\/\/www.mycompany.com\/myapp\/crossdomain.xml<\/a>. This is wrong and it won’t work<\/p>\n","protected":false},"excerpt":{"rendered":"
To enable a Silverlight control to access a web service (like a WCF Service) in another domain, the service must explicitly allow cross-domain access. Doing so, a service states that the operations it exposes can safely be invoked by a Silverlight control, without potentially damaging consequences to the data the service stores. Silverlight supports two […]<\/p>\n","protected":false},"author":362,"featured_media":12806,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1333","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cesardelatorre"],"acf":[],"blog_post_summary":"
To enable a Silverlight control to access a web service (like a WCF Service) in another domain, the service must explicitly allow cross-domain access. Doing so, a service states that the operations it exposes can safely be invoked by a Silverlight control, without potentially damaging consequences to the data the service stores. Silverlight supports two […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/posts\/1333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/users\/362"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/comments?post=1333"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/posts\/1333\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/media\/12806"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/media?parent=1333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/categories?post=1333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/cesardelatorre\/wp-json\/wp\/v2\/tags?post=1333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}