Silverlight 2 beta 1 and Socket Exception: Access Denied

Tags: .NET, Security, Silverlight

Playing around with the sockets in Silverlight 2 beta 1 I found out that it works fine on my local host. When publishing my sample to a real Web server (I mean a Web server that is reachable in the Internet with a domain) I got always a socket exception saying that access is denied. I looked around if I could find any help on that. I thought that there maybe is a restriction in the defaults of Silverlight and that I could find somewhere a configuration similar to the .NET and zones configuration, but I didn't.

Today I got the answer from Wilco Bauwer, Microsoft:

This is currently a limitation of the site-of-origin policy.  To prevent DNS rebinding, we need to verify that the IP address returned by the DNS query actually "belongs" to the domain specified; we do this with a reverse DNS lookup.  This dependence on the reverse lookup should go away in the next drop of Silverlight 2.

That means my online sample at frankfurt.schwarz-interactive.de returns a IP address that does not correspond with the DNS reverse lookup information. If you want to check the reverse DNS lookup of any IP address you can use nslookup.exe (for detailed information read the Wikipedia article about reverse DNS lookup):

First you have to set the type to query to PTR:

set type=ptr

To lookup for the domain name of a given IP address (the IP address Silverlight gets from resolving the domain used for the socket) you have to reverse the IP address and add ".in-addr.arpa." at the end. This means: the IP Address 82.165.8.108 gets 108.8.165.82.in-addr.arpa. Your nameserver will answer this with the name that is configured for this IP address:

CWindowssystem32cmd.exe - nslookup 

In my example I get schwarz-interactive.de instead of the used domain frankfurt.schwarz-interactive.de. Well, simple changing the sample to use http://schwarz-interactive.de:4510/test.aspx fixes this problem.

The next drop of Silverlight 2 will change this dependence. In the meantime, the easiest way to work around this is to reference the .xap file using'http://[ip address]:port/path/to/app.xap. No reverse lookup is needed in this case because Silverlight will simply do an equality test on the IP addresses.

9 Comments

  • Gopi said

    Mike, Is there a way to do a 2 - way communication with SL Sockets ? Liek SL client will open a socket and Listen, so i can push data from server when needed? Thanks, Gopi

  • Gopi said

    Thanks Mike, I was looking for something like Flex's real time data push.. which has a client side socket listner.. ! Gopi

  • Michael Schwarz said

    @Gopi: well, I think the Flex data pushing does not create a listener on the local PC but I don't know Flex enough. I think that Flex is opening a socket to the (Web) server and then waits for any response. If there is any event the client has subscribed to the server will write on that socket. You will get real pushed data insted of polled. So, I think it is working the same. Michael

  • Gopi said

    Mike, There is an Client side XmlSocket available in flex, which registers and listens (!), when data available, server pushes the data to the registered client's method ! That was beautiful for many senario's [esp, real time financial data push]. SL can make huge impact in Financial sector if implemented ! Gopi

  • Michael Schwarz said

    @Gopi: I still think that they don't have listeners on the socket layer. You have to think on something like an event handler that is waiting (listening) for new data sent to the client, but the connection has been established from the client. Firewalls and NAT would make listeners on the client-side unusable. I found this Flex code here: private function connectToServer():void { // // Step #1: Create the XMLSocket Instance // socket = new flash.net.XMLSocket(); // // Step #2: Register for event notifications // socket.addEventListener(Event.CONNECT, connectHandler); socket.addEventListener(DataEvent.DATA, dataHandler); // // Step #3: Create the physical connection with the server // socket.connect("mydomain.com", 5974); } You see that the client is establishing the connection. With an open connection to a socket server you are able to push data to the client whenever you want (but the connection must be left often from the client). Wait for my example using Silverlight... ;)

  • dotnetnoobie said

    Hello Michael, I have made a small Server/Client chat application with winforms server app and a silverlight client to run in the browser... I was wondering if you had any idea of when the nest silverlight release will be and if it will have the IP Address restrictions removed from it?

Comments have been disabled for this content.