Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am getting this error while creating a basic Silverlight Application. Below is the error message. I have placed the clientaccesspolicy.xml file in the folder C:\Inetpub\wwwroot. I am not sure if this file needs to be placed somewhere else.

I have also removed the Integrated Windows Authentication and it is set to Anonymous access. I am not sure what I am missing here.

~~~~~~~~~~~~~~~~~~~~ An unhandled exception (‘Unhandled Error in Silverlight Application Code: 4004 Category: managedRuntimeError Message: System.Security.SecurityException’ ). A security exception occurred while trying to connect to the REST end point

… Make sure you have a cross domain policy.xml.


<?xml version="1.0" encoding="utf-8" ?> 
<allow-from http-request-headers="*">
 <domain uri="*" /> 
 <domain uri="http://*" /> 
 <resource path="/" include-subpaths="true" /> 
share|improve this question
up vote 1 down vote accepted

I never used the ArcGIS Silverlight API but if its anything like 'standard' SL applications that consume WCF services you will need to have a crossdomain.xml file. This file should be on the folder where the SOAP service is located. A simple example of this file is:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE cross-domain-policy SYSTEM "">
  <allow-http-request-headers-from domain="*" headers="*"/>

For more information on the syntax/spec for this file check here.

share|improve this answer

You need either a Silverlight-style clientaccesspolicy.xml or a Flex-style crossdomain.xml file on the server you're trying to access when that server is different from where your Silverlight app itself is being hosted (including both domain and port number).

I.e. if your Silverlight app is hosted at and is trying to access then you need an access policy file on

If you don't know which server access is causing the security exception using a tool like Fiddler can help figure that out. Look for an outgoing request for clientaccesspolicy.xml and then crossdomain.xml where both are returning 404 Not Found and note the server name.

The important thing is that the policy file must be placed on the third-party server you're accessing. If you don't have access to that server, you'll have to ask the server admins nicely to help you out.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.