blog
Tag Archive for site-control at Jozef Chúťka's blog
September 16, 2010
crossdomain.xml loadPolicyFile policy Security site-control
Security.loadPolicyFile() Ignored … Not at all! (update)
I was about to publish an article about a bug in flash player, that loadPolicyFile() method fails when loading crossdomain policy files from a custom location (not domain root), but I soon realized that it is not a bug, but a feature :-) .
It seems like flash player (WIN 10,1,50,426, debug) ignores crossdomain files loaded from a custom location. The documentation defines Security.loadPolicyFile() as a method to be used to download “cross-domain policy file from a location specified by the url parameter”, it does not work at all. Even the custom crossdomain.xml is requested (debuged with proxy software), the flash application somehow ignores it and tries to load crossdomain.xml file from a domain root. And if there is none on the domain root (why would it be, when you need to load custom one) all your loads results in security error.
After some investigation, I found out, that it is required to have a domain root crossdomain file that allows handling with cross-domain files located besides domain root via site-control element. Long story short, cross-domain security is an alchemy and one should read the whole specification. Long story even shorter, if you have no access to domain root (and there is no required crossdomain file with allow-access-from or site-control), you are doomed (flash application will not let you handle file contents from the location) … please read the update part (not doomed at all)! Lets have a quick look at scenario with the site-control on domain root and allow-access-from on custom location: