Cross-Domain Ajax with Flash

This is a good article by Chris Shiflett is a principal of OmniTI, where he leads the web application security practice. If you have a public API and want to allow cross-domain Ajax requests with Flash, be sure to use a separate domain. If the user interface and API operate in the same domain, there's almost no limit to what an attacker can do.

Read Article