What could cause cross-domain-policy not to work?

Question

I was trying to communicate with a site on another domain. I'm using javascript(xhr) to communicate. I have created a crossdomain.xml with open access from all domains and added it to the root of the domain I want to communicate to. I can even access the file by pasting it's link in the address bar. But I still get the same error on chrome console

Origin xxxxxxxx.com is not allowed by Access-Control-Allow-Origin.

what could possible be the reason. Is there anything I'm overlooking?

Answer 1

what do you mean "with open access from all domains and added it to the root of the domain I want to communicate to"?

xhrs cannot hit other domains unless you use CORS .

You can access the file in the browser because it's not using an xhr when you type the URL in the address bar.

Answer 2

crossdomain.xml is a Flash thing, but your error message appears to be related to CORS.

You need to configure your server to send suitable HTTP response headers (and handle preflight OPTIONS requests) as per the specification

Answer 3

Using CORS means having all responses from the server return

"Access-Control-Allow-Origin" ":" origin-list-or-null | "*"

for example

"Access-Control-Allow-Origin:*"