Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage of this to create XSS flaws on the same domain as my other secured services.

Since I will not be serving flash from my site, and the presence of a flash document in the same domain will cause a security risk, I want to block all Flash-initiated XSS actions.

What is the recommended content of crossdomain.xml or clientaccess.xml?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

With regard to Flash issues, every site that doesn't use Flash should use one of the two files at the root of the web server named crossdomain.xml. This will prevent XSS via that plugin

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM  
 "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
  <site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>

The "Master Only" directive prevents any other file from being read, even if they have the correct content type. The MIME type of this file should be text/x-cross-domain-policy

share|improve this answer
    
How can Flash files appear in origin of your domain if user doesn't have an option to upload files to it's origin? –  Andrey Botalov Mar 16 '12 at 16:31

If you are worried about users uploading swfs you may also want to set: X-Content-Type-Options: nosniff

And you easily check the first few bytes of the file to determine if its a flash.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.