X-Permitted-Cross-Domain-Policies (X-Permitted-Cross-Domain-Policies)
The Importance of X-Permitted-Cross-Domain-Policies
This header was primarily needed when Adobe Flash was prevalent. Flash used crossdomain.xml files to determine whether cross-domain data access was allowed. A permissive crossdomain.xml could allow any Flash application on any website to load data from your server, potentially accessing sensitive information.
With Flash officially discontinued and removed from all modern browsers, the security risk this header addresses is minimal. However, setting X-Permitted-Cross-Domain-Policies: none is still recommended as a defense-in-depth measure. It costs nothing to include and prevents any edge case involving legacy PDF viewers or Flash remnants.
Security scanners still check for this header and flag its absence. Including it is a trivial configuration change that satisfies scanner requirements and provides marginal protection at no cost.
Checking Your Setup
A security audit checks for this header. Set X-Permitted-Cross-Domain-Policies: none unless you specifically need Adobe products to access your server's resources cross-domain, which is extremely rare in modern web applications.
Run a Security Audit