Update cross domain policy to only allow API access.

[rails.git] / config / lighttpd.conf

diff --git a/config/lighttpd.conf b/config/lighttpd.conf
index 74aa6f38f3628f16dfdd7eb64154df738ba8282a..7a9e241452cc9ebf2dd80dc328e383bb7c6b4b23 100644 (file)
--- a/config/lighttpd.conf
+++ b/config/lighttpd.conf
@@ -65,9 +65,17 @@ mimetype.assign = (
   ".js" => "application/x-javascript",
   ".png" => "image/png",
   ".swf" => "application/x-shockwave-flash",
-  ".txt" => "text/plain"
+  ".txt" => "text/plain",
+  ".xml" => "text/xml"
 )
 
+#
+# Force special MIME type for crossdomain.xml files
+#
+$HTTP["url"] =~ "/crossdomain\.xml$" {
+  mimetype.assign = ( ".xml" => "text/x-cross-domain-policy" )
+}
+
 #
 # Enable compression of appropriate static content
 #