On Nov 5, 2009, at 3:32 PM, codewarrior415 wrote:
OK, the crossdomain policy now only allows your flex application to access the API. You are not allowing flex appication access your API? How come the change again today. This morning it was working fine.
twitter.com's crossdomain.xml is exactly the same as it was last week, it was restored from the original configuration.
The search.twitter.com crossdomain.xml policy was incorrectly set to permit from all sites for all actions.
We've configured that to be identical to the twitter.com crossdomain.xml to prevent CSRF, session fixation, and attacks on user accounts, which is a major security issue which Facebook and Myspace fell to earlier this week.
Could you describe what you are trying to do and we'll research? -john
