at your root level use crossdomain.xml:
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<!---
this should be in the root and allows all policy files but gives access to no domains.
a policy file (eg, crossdomain2.xml) in a subdirectory with allow-access-from allows domain access to
the directory, and dependent subdirectories, that contain crossdomain2.xml
-->
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"/>
</cross-domain-policy>
and in a subdirectory that you want to allow access, use crossdomain2.xml:
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<!---
this policy file (eg, crossdomain2.xml) in a directory will allow access to that directory and its subdirectories
IF there's a root policy file allowing cross-domain-policies (eg, crossdomain.xml)
-->
<cross-domain-policy>
<!--<allow-access-from domain="www.adobe.com" />-->
<allow-access-from domain="www.adobe.com" />
</cross-domain-policy>
