Comment by wnevets

>Ensure use of Anti-CSRF tokens, CORS, and crossdomain.xml policies to prevent an attacker from forcing a user to submit authenticated requests.

isn't crossdomain.xml an adobe flash thing?