<p>In a silverlight application, I want to access the page the silverlight .xap file from an HTTP subdomain, but have the web services access a different subdomain for sensitive information over HTTPS.</p>

<p>I set up clientaccesspolicy.xml at the root of the subdomain and it lets the silverlight app access its services over http, but not over https.  It gives the cross domain access error that it would give normally without a clientaccesspolicy in place.</p>

<p>I know that browsers themselves have a lot of restrictions about mixing http and https.  Am I trying to do something that is not allowed?  </p>

[{'answer_id': 73598, 'author': 'MrHinsh - Martin Hinshelwood', 'author_id': 11799, 'author_profile': 'https://Stackoverflow.com/users/11799', 'pm_score': 2, 'selected': False, 'text': '<p>Check out:<a href="http://silverlight.net/forums/t/12741.aspx" rel="nofollow noreferrer">http://silverlight.net/forums/t/12741.aspx</a></p>\n\n<blockquote>\n  <p>You can either make https calls to the\n  same domain or http cross-domain\n  calls, but not https cross-domain\n  calls.</p>\n  \n  <p>This is described in\n  <a href="http://msdn2.microsoft.com/en-us/library/cc189008(VS.95).aspx" rel="nofollow noreferrer">http://msdn2.microsoft.com/en-us/library/cc189008(VS.95).aspx</a></p>\n  \n  <p>(see "If not HTTPS" in the matrix)\n  By JohnSpurlock</p>\n</blockquote>\n'}, {'answer_id': 403616, 'author': 'Pete', 'author_id': 3059, 'author_profile': 'https://Stackoverflow.com/users/3059', 'pm_score': 2, 'selected': False, 'text': '<p>This is out of date since Silverlight 2.0 was released.  You can now do most cross-domain scenarios with the appropriate configuration.  <a href="http://msdn.microsoft.com/en-us/library/cc197955(VS.95).aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/cc197955(VS.95).aspx</a></p>\n'}, {'answer_id': 1638953, 'author': 'degnome', 'author_id': 18218, 'author_profile': 'https://Stackoverflow.com/users/18218', 'pm_score': 0, 'selected': False, 'text': '<p>The important thing to note here that is not in the above information clearly is you must have access to the "ROOT" level of the domain request, and the clientaccesspolicy.xml must reside at that level.</p>\n\n<p>If for example you have a production environment that your application is behind a load balancer that directs traffic as most large companies do to your application via the URI, you then have a little bit of a problem.</p>\n\n<p>Example:  <a href="http://mydomain.com/MyApplication/" rel="nofollow noreferrer">http://mydomain.com/MyApplication/</a>*  goes to your server, where your app resides.\n          <a href="http://mydomain.com/clientaccesspolicy.xml" rel="nofollow noreferrer">http://mydomain.com/clientaccesspolicy.xml</a>  is where the policy exists.</p>\n'}]
['https://Stackoverflow.com/questions/73517', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/3059/']