CODEWITHSUNDEEP
apache-flexflashactionscript-3security
Eran Kampf
Eran Kampf

Reputation: 8986

How do I call a Flex SWF from a remote domain using Flash (AS3)?

I have a Flex swf hosted at http://www.a.com/a.swf. I have a flash code on another doamin that tries loading the SWF:

_loader = new Loader();
var req:URLRequest = new URLRequest("http://services.nuconomy.com/n.swf");
_loader.contentLoaderInfo.addEventListener(Event.COMPLETE,onLoaderFinish);
_loader.load(req);

On the onLoaderFinish event I try to load classes from the remote SWF and create them:

_loader.contentLoaderInfo.applicationDomain.getDefinition("someClassName") as Class

When this code runs I get the following exception

SecurityError: Error #2119: Security sandbox violation: caller http://localhost.service:1234/flashTest/Main.swf cannot access LoaderInfo.applicationDomain owned by http://www.b.com/b.swf.
    at flash.display::LoaderInfo/get applicationDomain()
    at NuconomyLoader/onLoaderFinish()

Is there any way to get this code working?

Upvotes: 2

Views: 4307

Answers (3)

grapefrukt
grapefrukt

Reputation: 27045

You'll need a crossdomain.xml policy file on the server that has the file you load, it should look a something like this:

<?xml version="1.0"?>
<!-- http://www.foo.com/crossdomain.xml -->
<cross-domain-policy>
  <allow-access-from domain="www.friendOfFoo.com" />
  <allow-access-from domain="*.foo.com" />
  <allow-access-from domain="105.216.0.40" />
</cross-domain-policy>

Put it as crossdomain.xml in the root of the domain you're loading from.

Also you need to set the loader to read this file as such:

var loaderContext:LoaderContext = new LoaderContext();
loaderContext.checkPolicyFile = true;

var loader:Loader = new Loader();
loader.contentLoaderInfo.addEventListener( Event.COMPLETE, onComplete );
loader.load( new URLRequest( "http://my.domain.com/image.png" ), loaderContext );

code sample yoinked from http://blog.log2e.com/2008/08/15/when-a-cross-domain-policy-file-is-not-enough/

Upvotes: 2

Theo
Theo

Reputation: 132862

This is all described in The Adobe Flex 3 Programming ActionScript 3 PDF on page 550 (Chapter 27: Flash Player Security / Cross-scripting):

If two SWF files written with ActionScript 3.0 are served from different domains—for example, http://siteA.com/swfA.swf and http://siteB.com/swfB.swf—then, by default, Flash Player does not allow swfA.swf to script swfB.swf, nor swfB.swf to script swfA.swf. A SWF file gives permission to SWF files from other domains by calling Security.allowDomain(). By calling Security.allowDomain("siteA.com"), swfB.swf gives SWF files from siteA.com permission to script it.

It goes on in some more detail, with diagrams and all.

Upvotes: 6

Rytmis
Rytmis

Reputation: 32047

Mayhaps System.Security.allowDomain is what you need?

Upvotes: 0

Related Questions