Question

I am building a Silverlight 4.0 web application for our intranet that will connect to a server via REST to get data. I am using Visual Studio 2010.

I am using the following code in a method to make the request:

var wc = new WebClient();
const string uri = "http://server/api/statistics.svc/overall/";

wc.OpenReadCompleted += new OpenReadCompletedEventHandler(wc_OpenReadCompleted);
wc.OpenReadAsync(new Uri(uri, UriKind.Absolute));

My OnReadCompleted event handler:

void wc_OpenReadCompleted(object sender, OpenReadCompletedEventArgs e)
{
    var buffer = new byte[e.Result.Length];

    e.Result.Read(buffer,0,(int)e.Result.Length);

    var xmlstr = buffer.Aggregate(String.Empty, (current, t) => current + (char) t);

    // Do something with xmlstr...
}

My issue arises when trying to run the application. The exception is thrown on line one in the wc_OpenReadCompleted event handler and has the following details:

 TargetInvocationException: An exception occurred during the operation, making the result invalid.  Check InnerException for exception details.

The inner exception:

 System.Security.SecurityException: Security error.

My REST service does not use any sort of authentication.

I have created a clientaccesspolicy.xml located at with the following settings:

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
  <cross-domain-access>
    <policy>
      <allow-from http-request-headers="*">
        <domain uri="*"/>
      </allow-from>
      <grant-to>
        <resource path="/api/statistics.svc/" include-subpaths="true"/>
      </grant-to>
    </policy>
  </cross-domain-access>
</access-policy>

Your help is greatly appreciated!

Thanks,

Jeffrey Kevin Pry

UPDATE

I wasn’t specifying /api/ in my xml file. The issue is resolved.

Thanks!

Answer 1

Your Silverlight application is allowed to connect only to the server it was downloaded from and to servers that have a Cross-domain Policy File. This is known as the Same Origin Policy. Connections to any other server are denied for security reasons.