<?xml version="1.0" encoding="UTF-8"?> <cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema- instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/ schemas/PolicyFile.xsd"> <allow-access-from domain="twitter.com" /> <allow-access-from domain="api.twitter.com" /> <allow-access-from domain="search.twitter.com" /> <allow-access-from domain="static.twitter.com" /> <site-control permitted-cross-domain-policies="master-only"/> <allow-http-request-headers-from domain="*.twitter.com" headers="*" secure="true"/> </cross-domain-policy>
Correct me if I am wrong here, but it seems like you guys are allowing access to yourself only. Can I request for my domain to be added on this list? So basically you guys are blocking everyone from accessing your API via Flex or Flash. I don't believe this is the same configuration as last week. If it was, then our application would not be throwing errors. On Nov 5, 4:08 pm, John Adams <[email protected]> wrote: > On Nov 5, 2009, at 3:32 PM, codewarrior415 wrote: > > > OK, the crossdomain policy now only allows your flex application to > > access the API. You are not allowing flex appication access your API? > > How come the change again today. This morning it was working fine. > > twitter.com's crossdomain.xml is exactly the same as it was last week, > it was restored from the original configuration. > > The search.twitter.com crossdomain.xml policy was incorrectly set to > permit from all sites for all actions. > > We've configured that to be identical to the twitter.com > crossdomain.xml to prevent CSRF, session fixation, and attacks on > user accounts, which is a major security issue which Facebook and > Myspace fell to earlier this week. > > Could you describe what you are trying to do and we'll research? > > -john
