Silverlight WCF Service Cross Domain Question

cross-domain, service, silverlight, web-services

Solution

Yes, you will need a clientaccesspolicy.xml file in the ROOT of your service domain(webservices.mydomain.net).

By default, Silverlight supports calls to Web services on the same domain or site of origin. Same domain means that calls must use the same sub domain, protocol, and port. This is for security reasons and prevents cross-domain forgery.

Here is an example file:

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
  <cross-domain-access>
    <policy>
      <allow-from http-request-headers="*">
        <domain uri="http://intranet.mydomain.net"/>
      </allow-from>
      <grant-to>
        <resource path="/" include-subpaths="true"/>
      </grant-to>
    </policy>
  </cross-domain-access>
</access-policy>

This would allow requests only from intranet.mydomain.net.

Edit

It has been asked: How would this work if I have two WCF Services? /ServiceA/a.svc and /ServiceB/b.svc and I want ServiceA to to be open to anyone, anywhere, and ServiceB to only work from my intranet?

Your policy file would look like this:

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
  <cross-domain-access>
    <policy>
      <allow-from http-request-headers="*">
        <domain uri="http://*"/>
      </allow-from>
      <grant-to>
        <resource path="/ServiceA/" include-subpaths="true"/>
      </grant-to>
    </policy>

    <policy>
      <allow-from http-request-headers="*">
        <domain uri="http://intranet.mydomain.net"/>
      </allow-from>
      <grant-to>
        <resource path="/ServiceB/" include-subpaths="true"/>
      </grant-to>
    </policy>
  </cross-domain-access>
</access-policy>

Problem

Original source