We briefly mentioned client access policy in Chapter 4, Implementing Application Logic, when we discussed cross-domain networking. The reason behind Silverlight's requirement for the client access policy file is to prevent network threats and to give administrators more control over which resources a remote client, such as Silverlight, is allowed to connect to.

Silverlight 5, which was recently released, adds a new feature of creating in-browser trusted applications, which aren't restricted by the security policy (just like trusted out-of-browser applications). In Silverlight 4, the only way to connect to a service, which doesn't expose the client access policy is to create a web service of our own (using WCF or any other technology) on the same domain as the Silverlight application and let it handle the cross-domain call.

Every time Silverlight makes a cross-domain call, either by WebClient or by referencing a service, the Silverlight runtime will first try...