The most commonly placed place for crossdomain.xml is a domain root folder, flash The player will default to detect the Crossdomain.xml file under this path, and the crossdomain.xml in this root directory is called master policy file, which we will use to remember this concept.
Crossdomain.xml's schema is that http://www.adobe.com/xml/dtds/cross-domain-policy.dtd, detailing the crossdomain.xml of each node's attribute options, and you can browse it yourself.
The root node of the crossdomain.xml must be cross-domain-policy:
It contains three child nodes: Site-control, Allow-access-from, Allow-http-request-headers-from
No attributes
Node Description:
Site-control
This node defines the meta-policy of the current domain
Meta-policy determines which policy files in this domain, except master policy file, can be accepted by the client
If this policy file is not master policy file,site-control this node will be ignored.
If you use ActionScript to specify a policy file with a non-master policy file, you must first check the child node of master policy file to confirm that the policy file you specified is authorized.
The Site-control property permitted-cross-domian-policies has 5 options: none--Any policy file is not allowed, including master policy file. Master-only don't have to explain. by-content-type--is allowed when the Content-type value of the HTTP header is text/x-cross-domain-policy. by-ftp-filename--only URLs that end with a filename are allowed. all--without introduction. The default value is master-only except for the socket policy file, which defaults to all.
Allow-access-from
Allow-http-request-headers-from
===============================================
Adobe strongly deprecated examples of crossdomain.xml files that allow access to all resources:
<?xml version= "1.0"?>
<! DOCTYPE Cross-domain-policy SYSTEM
"Http://www.adobe.com/xml/dtds/cross-domain-policy.dtd" >
<cross-domain-policy>
<site-control permitted-cross-domain-policies= "All"/>
<allow-access-from domain= "*" secure= "false"/>
<allow-http-request-headers-from domain= "*" headers= "*" secure= "false"/>
</cross-domain-policy>
