Cross-Domain Policy Files for Flash and Silverlight with WCF

15 באוגוסט 2009

11 תגובות

Introduction

In an earlier blog I described my motivation for upgrading an ASMX Web Service to WCF in a particular project.

In that project the client was a Flash client hosted in a web page. The upgrade was simple and, as long as I ran the client from within Flex Builder, it had no problem consuming the new self-hosted WCF service instead of the ASMX.

Allowing Cross-Domain Access

However, once I deployed the package outside the Flex Builder, all calls to the service failed. The reason was that the domain from which I had loaded the web page was not the same as the domain of the WCF service.

RIA applications like Flash and Silverlight regard such cross-domain accesses as potential security risks and block them – unless cross-domain policies on the server explicitly allow them. This requirement is relaxed in the development environment and enforced in a production environment, which explains why I had no problem during development.

So what if, like me, you would like certain services to serve clients even if they are loaded from other domains?

Well, the solution is to specify such permissions in a file called a Cross Domain Policy File and to make it accessible to clients at the domain URL. For instance, if your service resides at www.mycompany.com/Services/ProductsService.svc the file should be accessible as www.mycompany.com/crossdomain.xml.

Both Flash and Silverlight try to download such a file before accessing applications in the domain. By default they will look for a file called crossdomain.xml at the root of the domain. The Adobe cross-domain file specification can be found here. Tim Heuer shows how to create policy files for Silverlight here.

Problem: Exposing Cross-Domain Policy Files for a Self-Hosted WCF Service

When your service is being hosted by IIS it is easy to make the crossdomain.xml file accessible to clients, because it is straightforward to expose files using IIS. But, alas if you are using a self-hosted WCF service, it would seem that you are out of luck. Unless the WCF host delivers the crossdomain.xml file itself, it will not be accessible to remote clients.

Solution: Using WCF’s REST Support

Think about it, all we really need is to be able to respond to an HTTP Get request for the URL (such as www.mycompany.com/crossdomain.xml) by sending an HTTP response containing the contents of the cross-domain file.

WCF can easily support this with its support for RESTful services that I described in an earlier post.

Here are the configuration file and code snippets adapted where necessary for the task at hand.

<?xml version="1.0" encoding="utf-8" ?>

<configuration>

  <system.serviceModel>

    <services>

      <service name="ProductsService"

               behaviorConfiguration="ProductsServiceBehavior">

        <endpoint address="ProductsService.svc"

                  binding="basicHttpBinding"

                  contract="IProductsService" />

        <endpoint address=""

                  binding="webHttpBinding"

                  behaviorConfiguration="WebBehavior"

                  contract="IRestfulOperations" />

        <host>

          <baseAddresses>

            <add baseAddress="http://www.mycompany.com/" />

          </baseAddresses>

        </host>

      </service>

    </services>

    <behaviors>

      <endpointBehaviors>

        <behavior name="WebBehavior">

          <webHttp />

        </behavior>

      </endpointBehaviors>

    </behaviors>

  </system.serviceModel>

</configuration>

and here is the code (adapted from an answer by Carlos Figueira here).

    public partial class ProductsService : IProductsService, IPolicyRetriever

    {

        #region IPolicyRetriever Members

 

        public Stream GetPolicy()

        {

            string result = @"<?xml version=""1.0""?>

                <!DOCTYPE cross-domain-policy SYSTEM

                     ""http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"">

                <cross-domain-policy>

                    <allow-access-from domain=""*"" />

                    <allow-http-request-headers-from domain=""*"" headers=""SOAPAction""/>

                </cross-domain-policy>";

            WebOperationContext.Current.OutgoingResponse.ContentType = "application/xml";

            return new MemoryStream(Encoding.UTF8.GetBytes(result));

        }

 

        #endregion

    }

Summary

In this post I described how you can use WCF’s REST support to have a self-hosted service expose the cross-domain policy file required by Silverlight and Flash when calling into Web services.

This is one more proof that WCF is extremely versatile interoperable and can be used in applications with a variety of requirements, including RIA in applications such as Flash and Silverlight.

הוסף תגובה
facebook linkedin twitter email

כתיבת תגובה

האימייל לא יוצג באתר. שדות החובה מסומנים *

11 תגובות

  1. Safet3 בספטמבר 2012 ב 16:52

    I quite prefer what you smbuit in this article. Rather insightful and intelligent. One challenge though. I’m running Internet explorer with Debian and parts of your current web design pieces are a little wonky. I realize it’s not a usual set up. Yet still it’s an issue to retain in view. I trust that it can help and always keep in the main quality writing.

    הגב
  2. Madrid2 במאי 2013 ב 14:50

    The internet is fueling the success of music because it can be
    listened to at any time of the day and anywhere in the world.
    This means that everyone in the whole wide world
    can access this new kind of radio and you are assured that the programs
    as well as the list of radio stations you are listening to are all automatically updated.

    But mostly BBC Radios 4 and 5 because, being
    speech orientated, they're more like what I do, so I can learn lots from them.

    הגב
  3. Stapleton2 במאי 2013 ב 14:57

    Enjoy the public open-air concept loo and shower area.
    As we ate, not only did our waitress check back with us to see
    if we required anything further, but the manager stopped by as well.

    It is a very capable digital audio editor, that has multiple options
    for remixing and refining the various sounds you can create.

    הגב
  4. Bower2 במאי 2013 ב 16:18

    Broadcast satellite "in the Star on the 9th," was successfully launched in June last year,
    it can be said is a milestone in the field of live satellite event.
    So your personal, non-commercial, watercraft is exempt from a licensing requirement.
    Whats more is that 2G phones can come in a tinier and slimmer package,
    even its batteries.

    הגב
  5. Haggerty2 במאי 2013 ב 17:20

    Better you connect another mouse with your computer.
    G500s Laser Gaming Mouse packs a gaming grade laser for precise cursor control on a
    wide variety of surfaces and a hyper-fast dual-mode scroll wheel.
    As one of the most innovative and quality computer peripheral
    device makers in the world, Switzerland-based Logitech International.

    הגב
  6. Sibley3 במאי 2013 ב 3:21

    Even though your goal is just to lose 5 pounds in a week, you should be strict with what you do so as not
    to inadvertently undo all your hard work for vegetarian weight loss.
    Cucumber contains sterols which can help to lower cholesterol and prevent carbohydrates
    from converting to body fat. Who does not need that
    little bit of elevation when trying to diet.

    הגב
  7. Luciano3 במאי 2013 ב 23:10

    Even though your goal is just to lose 5 pounds in a
    week, you should be strict with what you do so as not to inadvertently undo
    all your hard work for vegetarian weight loss. Withdrawal from
    levothyroxine can be done but it takes 6 weeks of withdrawal for the remaining thyroid tissue to be completely starved.

    Expect to lose all that extra flabbiness as
    you melt off all your unwanted fat.

    הגב
  8. Howerton29 באוגוסט 2013 ב 16:06

    Greate post. Keep posting such kind of information on your blog.
    Im really impressed by it.
    Hey there, You have done an incredible job.
    I will certainly digg it and in my opinion recommend to my friends.
    I'm sure they'll be benefited from this site.

    הגב
  9. Salley29 בספטמבר 2013 ב 11:31

    True to what you mentioned on the post. In my article I have produce on the familar topic but
    more to the studio lighting matters.

    הגב
  10. Bannister6 באוקטובר 2013 ב 6:21

    After all, that's what most of the bands do these days, so he claimed.
    When played in combinations they produce great sounding chord sequences and hence are what many well-known riffs are composed of.
    Don't be hard on yourself and don't get discouraged.

    הגב
  11. Oconnor25 באוקטובר 2013 ב 12:24

    We're a gaggle of volunteers and opening a brand new scheme in our community.
    Your website provided us with helpful information to work on.
    You've performed an impressive activity and our entire group will likely be thankful to you.

    הגב