Skip to Content



The Adobe cross-domain policy file:  has to be located in the root folder of your application server. For the ABAP Web AS it is not so easy to place file into the root folder. One option is to use a default service (e.g. BSP) and place the file into the mime repository of this BSP. But what if you also want to have a “real” default service? Here I would like to show you a different method what eliminates this issue, and is simple to implement.

h3. Crossdomain.xml in the ICM Server cache

We will use the caching mechanism of the ICM to store the file for us in the root folder. We upload the file in a periodic job every day, and let the ICM will keep the file for us for a day in the cache.

Here is the code you can use in your report. You only need to modify the ‘concatenate’ section with the content of your crossdomain.xml file.



<br />”Create the Crossdomain.xml<br />”

DATA crossdomainxml_t type string.

DATA crossdomainxml   type xstring.


‘<?xml version=”1.0″ encoding=”UTF-8″ ?>’

‘<cross-domain-policy xmlns:xsi=””‘


‘<allow-access-from domain=”” /> ‘

‘<site-control permitted-cross-domain-policies=”master-only” />’

‘<allow-http-request-headers-from domain=”” headers=”” secure=”true” />’


into crossdomainxml_t SEPARATED BY SPACE.

“convert to binary



TEXT           = crossdomainxml_t


BUFFER         = crossdomainxml


” Create Response object with the crossdomain data”

data lr_cached_response type ref to if_http_response.  create object lr_cached_response type cl_http_response exporting add_c_msg = 1.  lr_cached_response->set_data( crossdomainxml ).  lr_cached_response->set_content_type( ‘text/xml’ ). lr_cached_response->set_status( code = 200 reason = ‘OK’ ). “set the validity for more than a day(86400)  lr_cached_response->server_cache_expire_rel( expires_rel = 90000 ).

“Upload to the ICM root directory”

URL      = ‘/crossdomain.xml’
RESPONSE = lr_cached_response


Creating a background job to upload the file into the cache.

    1. Start Tr. SM36 and start the Job wizard and select ‘Continue’
    2. Enter Job Name ( I used ZCROSSDOMAIN. ) and hit ‘Continue’.
    3. Select ABAP Program Step and again ‘Continue’
    4. As ABAP Program name enter the name of the program you have just created. Click ‘Continue’. No additional steps are necessary for our job, so select again ‘Continue’.
    5. Select ‘Date / Time’ as start condition. Click ‘Continue’
    6. On the next screen you can enter 1:00 AM the next day as start time and select the flag for periodic job. Click ‘Continue’
    7. Select Daily on the next screen. Click ‘Continue’
    8. Click ‘Complete’

Now you have a job that will upload the file into the server cache every day. Only thing you have to take care about: Run the report after you have restarted the ICM or deleted the ICM cache.


To report this post you need to login first.


You must be Logged on to comment or reply to a post.

  1. Former Member
    I am not sure if I should add this as a comment to your blog but ….
    We have used the BSP service before in some implementations to put in the crossdomain.xml file..
    One persistent question that I face is :
    What is the root directory of the ABAp WAS..? this question has been asked by the BASIS team in two of my projects and if you could answer the same in terms of :
    1. Relative path to place the file
    2. Permissions on the file in terms of CHMOD etc considering UNIX systems..

    this would be great because it is uslally a lot of red tape to put files on the root directory and if we get it wrong we get screamed at for taking so much time and we are not too sure where to place the file in leading to us implementing the BSP solution instead.

    Thanks and Warm regards,
    Arun Varadarajan

    1. Dezso Pap Post author

      this is not a directory in the file system. In the ABAP a “Web response” is coming from your SAP System. This based on the cache of the icm, or result of ABAP handlers. The ABAP system is working based on database tables and not on file system documents, as a result of this the folders of the Web AS are not folders of the file system, just virtual places that have meaning only inside the system.

      Best regards,

  2. Former Member
    I have a directory in Mime Repository:


    I have loaded .SWF (Flex) and BSP Page that consumes this .SWF.

    The .SWF call BW Query and display the simple result.

    And lets say : Web AS URL is

    Where should I place my Cross Domain Policy file here ?

  3. Sergio Ferrari
    Thanks for sharing this idea.

    I’d like to add that in case of double stack (ABAP+J2EE) crossdomain.xml is to be placed on the engine in charge for the default root.

    Profile parameter is/HTTP/default_root_hdl is very important and if set to J2EE all the incoming HTTP requests for the /crossdomain.xml will be managed by J2EE and not by the ABAP.
    So before using the proposed solution, be sure is/HTTP/default_root_hdl is set to ABAP.
    *********************** from DOCUMENTATION **********************
    Parameter : is/HTTP/default_root_hdl
    Short description : Default HTTP handler for root-URL (“/”)
    Parameter description :
    You can use this parameter to determine the processor for an HTTP
    request that points to the root directory (this is a URL without
    path specification, such as “/” or “/index.html”).
    You can select either the ABAP processor or the J2EE processor to
    process requests of this type.
    *********************** from DOCUMENTATION **********************



Leave a Reply