Flash pioneered cross-origin data fetching long before the W3C standardized Cross-Origin Resource Sharing (CORS). Flash applications relied on `crossdomain.xml` policy files hosted at the web root to grant explicit permission for SWF movies running on external domains to read data.
1. Flash crossdomain.xml vs Modern HTTP CORS Headers
| Security Concept | Flash Implementation (`crossdomain.xml`) | Modern Web Implementation (HTTP Headers) |
|---|---|---|
| Allowed Origin | <allow-access-from domain="*.site.com" /> | Access-Control-Allow-Origin: https://site.com |
| Allowed Headers | <allow-http-request-headers-from domain="*" headers="*" /> | Access-Control-Allow-Headers: Authorization, Content-Type |
| Credentialed Access | secure="true" (HTTPS strictly enforced) | Access-Control-Allow-Credentials: true |
| Pre-Flight Check | HTTP GET request for /crossdomain.xml | HTTP OPTIONS pre-flight handshake |
