silverlight 跨域策略背后的基本原理是什么？
我在尝试调用远程休息 Web 服务时遇到问题 https://stackoverflow.com/questions/5442175/error-on-httpwebrequest
这似乎是由于远程服务器上缺少跨域策略文件 http://forums.silverlight.net/forums/p/183993/419448。 aspx
我不明白有这个文件的原因。它根本不能保护用户，那么他们创建此限制的目的是什么？
更新：阅读 MS 的解释后，我仍然无法看到此策略如何让用户更加了解，因为这一切都是在服务器端完成的，而没有通知用户任何事情。
更新：似乎人们不同意，所以毕竟我的问题并不那么愚蠢:)答案是保护服务而不是用户？例如，为什么 Twitter 会在不想要的情况下保护其服务呢？如果一个网站想要保护自己，那么它只需输入一些登录名/密码:) 很明显，一个网站希望从浏览器获得最大的访问权限，浏览器是否使用插件并不重要，为什么该网站会关心呢？
I got a problem when trying to call a remote rest webservice
https://stackoverflow.com/questions/5442175/error-on-httpwebrequest
It seems it's due to cross domain policy file missing on the remote server
http://forums.silverlight.net/forums/p/183993/419448.aspx
I don't understand the reason to have this file. It doesn't protect the user at all so for what purpose did they create this restriction ?
UPDATE: Reading the explanation from MS I still fail to see how this policy allows user to be more aware since it's all done on servers side WITHOUT EVER NOTIFYING THE USER OF ANYTHING.
UPDATE: Seems people don't agree so after all my question is not so stupid :) Answer would be Secure the service not the User ? Why on earth would twitter for example would like to protect its service without even wanting it ? If a website would want to protect itself it would just well put some login / password :) It is obvious that a site wants greatest access from browser it doesn't matter if browser uses plugin or not why would the site care ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这是为了安全并让您实际上选择允许它。
MSDN 解释得最好，所以有我重新措辞没有意义：
It's for security and making you actually OPT IN to allowing it.
MSDN explains it the best so there is no point in me re-wording it:
这里有一些需要考虑的事情。假设 Silverlight 不需要 Web 服务来选择由 Silverlight 客户端或 Flash 客户端使用。
一些恶意者设法找到流行 Web 服务 API 中的弱点，并在 Silverlight 或 Flash 中编写漏洞利用程序。伤害已经造成，该网络服务的用户感到不安。责任的手指可能指向哪里？当有消息称 Silverlight 或 Flash 插件是某些违规行为的“原因”时，会发生什么？损害了谁的名誉？答：微软/Adobe虽然事实上与他们没有任何关系。
归根结底，这是关于公共关系，关于存在感知不安全感的风险，但实际上没有任何理由。
通过包含此选择加入要求，这些公司大大减少了可能使用其插件利用的服务数量。大大降低了他们的插件因不必要的声誉而受到不公平玷污的风险。对于那些选择加入的人，策略文件可以被视为服务提供商的责任，他们做出了明智的选择以包含此类文件。
最终，如果要做出选择，要么冒着公众认知的风险，面对 100,000,000 名潜在用户，要么冒着让大约 100,000 名潜在开发者感到不满和困惑的风险，我知道我会选择哪一个。
Here is something to consider. Assume a world where Silverlight did not require a web service to opt into being used by a Silverlight client or a indeed a Flash client come to that.
Some malcontent manages to find a weakness in a popular web service API and writes an exploit in Silverlight or Flash. Harm is done and users of this web service are upset. Where might the finger of responsibility get pointed? What happens when it gets into the news that a Silverlight or Flash plugin was the "cause" of some breach? Whose reputation is harmed? Answer: Microsoft / Adobe even though in fact it has nothing to do with them.
Ultimately this is about public relations, about the risk of there being a perceived insecurity where none is really warranted.
By including this opt-in requirement these companies massively reduce the number of services that could possibly be exploited using their plugins. Significantly reducing the risk that their plugin would unfairly be tarnished with an uncalled for reputation. For those that do opt-in the policy files can be pointed at as the responsibility of the service provider who made an informed choice to include such a file.
Ultimately if there is a choice between risking your public perception with 100,000,000 potential users or risk some disgruntlement and bewilderment of some 100,000 potential developers I know which one I would pick.
想象一下，您的网站上有一个 Web 服务，它显示实时股票，并且您希望该网站仅由您的 silverlight 客户端使用。
现在我可以编写一个 silverlight 客户端并将其放在我的网站上，该客户端将从您的网站获取数据，我可以窃取您的数据，用户会觉得这是我的数据。因为无法确定是谁在连接它。
因此，除非您从您的域允许，否则从我的域加载的 silverlight 将无法连接。这不是为了服务器客户端安全，而是为了跨域安全。与 JavaScript 跨域安全性相同，您无法访问从不同域加载的任何对象。
Imagine you have a webservice, which is on your website, it displays live stocks and you want this website to be used by only your silverlight client.
Now I can write a silverlight client and put it on my website that will fetch data from your website, I can steal your data and users will feel it's my data. As there is no way o determine who is connecting it.
So silverlight loaded from my domain will not connect unless you allow from your domain. This is not for server client security but this is for cross domain security. Same as JavaScript cross domain security that you can not access any objects loaded from different domain.