Question

I'm attempting to write a BugzScout class for my Silverlight application. Problem is that Silverlight isn't allowing me to access the API via HTTPS GET because there is no cross domain security policy in place. I'm getting a SecurityException each time I call.

In order to make this work, I'd need either a CrossDomain.xml or ClientAccessPolicy.xml file in place at the 'root of the domain', e.g.:

https://myproject.fogbugz.com/clientaccesspolicy.xml

this file should contain something like:

<access-policy>
    <cross-domain-access>
        <policy>
            <allow-from http-methods="GET">
                <domain uri="https://*" />
            </allow-from>
            <grant-to>
                <resource path="/" include-subpaths="true" />
            </grant-to>
        </policy>
    </cross-domain-access>
</access-policy>

I'm sure you could lock it down quite a bit more after investigating your options, this is a fairly liberal policy.

This isn't something that I can 'fix' from my side, my only workaround would be to create another web service somewhere that has the security policy file and acts as an intermediary between my Silverlight code and the Fogbugz API.

Answer 1

Sorry, because it's a shared environment, we have to be conservative about what we allow. The intermediary web service is, for the foreseeable future, going to be your only option.