Why crossdomain.xml

Question

sorry i don't get it:
why should having a crossdomain.xml policy file on the server
that i load data from add any security?
if i'd operate a malicous site i'd just put the
crossdomain.xml on my site.
it does not seem logic to me that any server can decide if it
is secure that a flash app can load data from it.
it would seem more reasonable that the flex/flash app itself
decides where it is safe to load data from.
i don't understand the security underlying this concept.
what am i missing here?
thanks,
maxflex

Answer 1

Thanks for sharing that URL. I think this is the section that applies to my XSS issue:
If you imagine that the "public server" is instead a "hacker's server," and that instead of pushing out nice public content he's sharing harmful links to malware, etc., then I think you see the problem
"A public server that allows data access from any domain
Some sites are intended to be accessed by anyone. They contain publicly available data, such as news feeds and web services.
The Flash Player, and web browsers, generally disallow access to data outside the current domain. Because of this, a common practice is to deploy a proxy script on the server that hosts the Flash movie, which then requests data server-side before returning it to the movie.
This is a standard practice, but it requires the creator of the Flash movie create server-side logic just to access public data. If the public server has a policy file, all Flash movies can access its data without any additional server scripts.
A policy file that permits all domains to access it uses a wild card instead of specifying individual domains.
<?xml version="1.0"?>
         <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
         <cross-domain-policy>
         <allow-access-from domain="*" />
         </cross-domain-policy> "