What is the point of a Policy Server? (Silverlight)

Answer 1

Quote:

Using for cross-domain communication requires guarding against several types of security vulnerability that can be used to exploit Web applications. Cross-site forgery is a class of exploits that becomes a threat when allowing cross-domain calls. This exploit involves a malicious Silverlight control transmitting unauthorized commands to a third-party service, without the user's knowledge. To prevent cross-site request forgery, Silverlight only allows site-of-origin communication by default for all requests other than images and media. For example, a Silverlight control hosted at http://contoso.com/mycontrol.aspx can only access services on that same domain by default – for example http://contoso.com/service.svc, but not a service at http://fabrikam.com/service.svc. This prevents a malicious Silverlight control hosted on the http://contoso.com domain from calling unauthorized operations on a service hosted on the http://fabrikam.com domain.

To enable a Silverlight control to access a service in another domain, the service must explicitly opt-in to allow cross-domain access. By opting-in, a service states that the operations it exposes can safely be invoked by a Silverlight control, without potentially damaging consequences to the data the service stores.

---

EDIT: based on comment/question ...

I'll just give my probably imperfect understanding of the situation, but this makes sense to me.

A browser in general is constrained in what it can route you to, by making it difficult to access any host other than the one serving up http pages. This is true no matter what resource is under discussion. And these constraints need to be applied by inference to anything else that runs in the context of the browser/web page, including Silverlight. So this is just extrapolating an existing mechanism for allowing foreign references.

I'm not sure how you intend to distinguish a "service" from a "socket". Generally services use sockets; there's some process (service or otherwise) sitting on a host watching to make connections on a port; one type of connection is a socket.

Answer 2

I finally figured out one good reason to do this.

Silverlight apps have the possibility of being distributed/executed very quickly. Say, as advertisements on a popular site for example. In that case it would be very easy for someone to use a Silverlight app to run a DoS attack on a host simply by giving it to an advertising provider. However since all Silverlight apps check the policy file for the host first it limits what hosts and services this kind of attack can target.