After a very long run, Adobe Flash is dead!

This was very long overdue for a variety of reasons. While Flash became almost ubiquitous on the web under Macromedia before being acquired by Adobe, it was also full of .
Apple never offered Flash on it’s mobile devices and helped to drive developers to make use of modern HTML5 to accomplish many of the same effects.
Flash “cookies” were buried deep within the application and were not easily removed by users making them very useful for tracking users.

Timeline:

Step Date
End of Life Announced July 25, 2017
End of support December 31, 2020
Flash blocked January 12, 2021

Support:

Browser Blocked Removed
Chrome 76 88
Firefox 69 85
Safari 14

 

crossdomain.xml

Adobe FlashPlayer 7 added several security features. I first became aware of this one as I saw a large number of HTTP 404 errors for a file named ‘crossdomain.xml’ in my webserver logs. (see also clientaccesspolicy.xml)

If you use flash on your website, I’d suggest adding an appropriate copy of this file to limit your exposure to some potential security issues.

Restricted domains

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.example.com" />
<allow-access-from domain="example.com" />
</cross-domain-policy>

Open to all domains (not recommended, but fully backward compatible)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*"/>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

REFERENCES: