Is a permissive
crossdomain.xml Flash policy analogous to a permissive CORS policy?
<cross-domain-policy> <allow-access-from domain="*" /> </cross-domain-policy>
the equivalent of
Access-Control-Allow-Origin: <origin request header> Access-Control-Allow-Credentials: true
e.g. if the attacker site is
attacker-site.co.uk over TLS the following headers would be reflected:
Access-Control-Allow-Origin: https://attacker-site.co.uk Access-Control-Allow-Credentials: true
I would argue that the Flash policy makes things more insecure (from a Flash perspective only) because although they appear to allow the same things, write access is not allowed by Flash unless a permissive cross domain policy file exists, whereas write access to an origin is allowed by default within the Same Origin Policy.
However, since write-access is allowed anyway (non Flash), allowing it in Flash too does not add any integrity risk to the application. Is this correct?