2

Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage of this to create XSS flaws on the same domain as my other secured services.

Since I will not be serving flash from my site, and the presence of a flash document in the same domain will cause a security risk, I want to block all Flash-initiated XSS actions.

What is the recommended content of crossdomain.xml or clientaccess.xml?

Improve this question
1

2 Answers 2

Reset to default
1

With regard to Flash issues, every site that doesn't use Flash should use one of the two files at the root of the web server named crossdomain.xml. This will prevent XSS via that plugin

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM  
 "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">

<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
  <site-control permitted-cross-domain-policies="master-only"/>
</cross-domain-policy>

The "Master Only" directive prevents any other file from being read, even if they have the correct content type. The MIME type of this file should be text/x-cross-domain-policy

Improve this answer
1
  • How can Flash files appear in origin of your domain if user doesn't have an option to upload files to it's origin?
    – Andrei Botalov
    Mar 16, 2012 at 16:31
1

If you are worried about users uploading swfs you may also want to set: X-Content-Type-Options: nosniff

And you easily check the first few bytes of the file to determine if its a flash.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .