
Content-Type is allowed on cross-domain request by default
Summary
The supported cross-domain policy files (crossdomain.xml and clientaccesspolicy.xml) are no longer required to explicitly allow the Content-Type request header. The Content-Type header is always settable on a POST xdomain request, as long as the request itself is allowed by a cross-domain policy file.
In addition, the LoadRuntime function has moved to IXcpControl2.
Fix Required
Previously, you needed to specify Content-Type in the headers allow list. Now, Content-Type is always allowed, so the "Content-Type" attribute value is no longer required just for setting the Content-Type (see the following examples).
clientaccesspolicy.xml
The following is the old version that explicitly listed Content-Type as settable. (This file still works in the Silverlight 2 final release.)
<?xml version="1.0"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="Content-Type, SOAPAction">
<domain uri="*"/>
</allow-from>
<grant-to>
<resource include-subpaths="true" path="/"/>
</grant-to>
</policy>
</cross-domain-access>
</access-policy>
The following is the new version that still allows Content-Type to be set.
<?xml version="1.0"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="SOAPAction">
<domain uri="*"/>
</allow-from>
<grant-to>
<resource include-subpaths="true" path="/"/>
</grant-to>
</policy>
</cross-domain-access>
</access-policy>
crossdomain.xml
The following is the old version that explicitly listed Content-Type as settable. (This file still works in the Silverlight 2 final release.)
<?xml version="1.0"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="* " />
<allow-http-request-headers-from domain="* " headers="Content-Type, SOAPAction" secure="true" />
</cross-domain-policy>
The following is the new version that still allows Content-Type to be set.
<?xml version="1.0"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="* " />
<allow-http-request-headers-from domain="* " headers="SOAPAction" secure="true" />
</cross-domain-policy>