A security exception occurred while trying to connect to the REST end point, Silverlight

Question

I am getting this error while creating a basic Silverlight Application. Below is the error message. I have placed the clientaccesspolicy.xml file in the folder C:\Inetpub\wwwroot. I am not sure if this file needs to be placed somewhere else.

I have also removed the Integrated Windows Authentication and it is set to Anonymous access. I am not sure what I am missing here.

Thanks jay

~~~~~~~~~~~~~~~~~~~~ An unhandled exception (‘Unhandled Error in Silverlight Application Code: 4004 Category: managedRuntimeError Message: System.Security.SecurityException’ ). A security exception occurred while trying to connect to the REST end point

… Make sure you have a cross domain policy.xml.

ClientAccessPolicy.xml:

<?xml version="1.0" encoding="utf-8" ?> 
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
 <domain uri="*" /> 
 <domain uri="http://*" /> 
</allow-from>
<grant-to>
 <resource path="/" include-subpaths="true" /> 
</grant-to>
</policy>
</cross-domain-access>
</access-policy>

Answer 1

I never used the ArcGIS Silverlight API but if its anything like 'standard' SL applications that consume WCF services you will need to have a crossdomain.xml file. This file should be on the folder where the SOAP service is located. A simple example of this file is:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
  <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

For more information on the syntax/spec for this file check here.

Answer 2

You need either a Silverlight-style clientaccesspolicy.xml or a Flex-style crossdomain.xml file on the server you're trying to access when that server is different from where your Silverlight app itself is being hosted (including both domain and port number).

I.e. if your Silverlight app is hosted at http://www.example.com/sample.xap and is trying to access http://www.foobar.com/arcgis/rest/service/Foo/MapServer then you need an access policy file on www.foobar.com.

If you don't know which server access is causing the security exception using a tool like Fiddler can help figure that out. Look for an outgoing request for clientaccesspolicy.xml and then crossdomain.xml where both are returning 404 Not Found and note the server name.

The important thing is that the policy file must be placed on the third-party server you're accessing. If you don't have access to that server, you'll have to ask the server admins nicely to help you out.