The One Header on All 56 Pages That Belongs to a Plugin Runtime: x-permitted-cross-domain-policies
I work on OnePassApps, the team behind app.onepassapps.com. This is our own host, and every number below was measured today, 11 November 2026, over plain HTTPS with no cookies and no JavaScript. One of the headers our p
I work on OnePassApps, the team behind app.onepassapps.com. This is our own host, and every number below was measured today, 11 November 2026, over plain HTTPS with no cookies and no JavaScript.
One of the headers our pages send belongs to a plugin runtime that no page of ours loads. It is x-permitted-cross-domain-policies, and its value is none.
What the header is for
X-Permitted-Cross-Domain-Policies is an old header, added for Adobe Flash and for Microsoft's Silverlight. Both runtimes would fetch a policy file from the site root before loading content across origins, and this header tells them not to look. The value none is the setting that means no policy file, do not ask.
Our host sends it on every response I measured, and there is no plugin content in the home page at all.
Where it appears
- 56 of 56: every URL in our own sitemap answers 200 and carries
x-permitted-cross-domain-policies: none. - It is on every other surface I checked on the document host too:
robots.txt(160 bytes),sitemap.xml(4,046 bytes),llms.txt(17,965 bytes),site.webmanifest(876 bytes),favicon.ico(3,556 bytes),apple-touch-icon.png(3,492 bytes), the hashed CSS (256,322 bytes) and the hashed JavaScript (694 bytes). - It is on the 404 page as well: an unknown route answers 404 with our own HTML, 14,173 bytes, with the same header.
- And it is on the API host:
/api/health(410 bytes),/api/products(15,650 bytes),/api/plans(4,020 bytes) and/api/voting(4,146 bytes) all carry it.
That last group is the surprise: a browser-side plugin instruction, riding along on JSON API answers as well as on HTML.
An earlier post here printed the full header set our document host sends, so the list of names is not news: that post is the canonical write-up for the inventory. What is new here is what this one header is for, and what the site does not have to go with it.
The policy files are not there
The header tells a runtime not to look for a policy file. I looked anyway, at the five policy paths that matter:
/crossdomain.xml/clientaccesspolicy.xml/client-access-policy.xml/cross-domain.xml/crossdomainpolicy.xml
All five answer 404 with our own HTML page, 14,173 bytes each, the same body our unknown-route 404 serves.
The HTML has no plugin in it
The home page's served HTML is 25,011 bytes. Inside it, crossdomain, swf, flash, silverlight, <object, <embed, <applet and clientaccesspolicy each appear 0 times. There is no plugin content in the home page at all.
What that means in practice
Two things, and they point in opposite directions.
The useful part: it is a one-line instruction to an old runtime, it costs one header line, and it means a Flash or Silverlight page is told not to go looking for a cross-domain permission file on our host. Cheap insurance for a runtime that no longer ships.
The dead part: the runtime it addresses is gone, the policy files it would point at do not exist, and the documents it travels with have no plugin in them. Our pages carry it because the host sets it on the responses it sends, not because anything here needs it. The API host sets it too, and a JSON answer has no plugin to protect.
If you want to see what else our host sends, the File Studio runs entirely in your browser tab and never uploads the file, and every app and studio has a plain-language guide with its limits and its tool list:
What this does not cover
One build, one day, one network, one region. Plain HTTPS, signed out, no cookies, no JavaScript. I measured the document host's 56 sitemap URLs, its root files, two hashed assets, one unknown route, and four API routes; I did not open a browser, did not check subdomains, and did not look at any host other than app.onepassapps.com and api.onepassapps.com.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.