Why is Flash demanding a crossdomain.xml file when the .swf and http target are both on localhost?

flash apache-flex actionscript-3 crossdomain.xml
Russ picture Russ · Jun 3, 2011 · Viewed 13.6k times · Source

I've got a small client/server test application where I have a Flex app that makes an HTTP request of a server app. The server app is a script running on my local machine, listening on port 8001. The client is a swf that I am running locally, and uses mx.rpc.http.HTTPService to make the page request.

The HTTPService is being set up as per below:

_HttpService = new HTTPService();
_HttpService.url = "http://localhost:8001";
_HttpService.contentType = "text/xml";

When I make a basic page request, my server app is first receiving a "GET /crossdomain.xml HTTP/1.1" request, which is failing since I don't have a crossdomain.xml file in place. The reason I don't have one in place is because this is all happening on my local machine (for now) and I shouldn't need one (I don't think).

I definitely had this code working before without a crossdomain.xml when I was using Flex 3.x. I thought I had it working with Flex 4 as well. Now I'm using Flex 4.5. Is there an issue here, possibly due to security policy changes?

With all of this happening on localhost, why is the Flash player requesting a crossdomain.xml file?

In case it helps, the specific fault my AsyncResponder is getting back is:

[FaultEvent fault=[RPC Fault faultString="Security error accessing url" faultCode="Channel.Security.Error" faultDetail="Destination: DefaultHTTP"] messageId="F43DCBFF-E99A-99CC-57D8-535C13C7CD48" type="fault" bubbles=false cancelable=true eventPhase=2]

Answer

mrdc picture mrdc · Jun 3, 2011

It may be that although you have the same host and protocol between the client page and server, the different port causes Flash to fail the same-origin test and request the crossdomain.xml to see what it's allowed to do. I'm assuming the page hosting your Flash content is running on port 80? If that's the case, check out Wikipedia's article on the same origin policy (http://en.wikipedia.org/wiki/Same_origin_policy) for the details.

The crossdomain.xml doesn't seem to be too cumbersome for local testing and is pretty well documented on help.adobe.com. You can create a crossdomain.xml in the root of your website like this, which will allow all access:

<?xml version="1.0"?> 
<!-- http://localhost/site/crossdomain.xml --> 
<cross-domain-policy> 
    <site-control permitted-cross-domain-policies="all"/> 
    <allow-access-from domain="*" to-ports="*"/> 
</cross-domain-policy>

I wouldn't use the above for anything other than local development as you're basically allowing any domain to request content.

Hope this helps!

Related questions

For VS Foreach on Array performance (in AS3/Flex)

Which one is faster? Why? var messages:Array = [.....] // 1 - for var len:int = messages.length; for (var i:int = 0; i < len; i++) { var o:Object = messages[i]; // ... } // 2 - foreach for each (var o:Object in messages) { // ... }

Read More
Regex to check if first 2 characters in a string are Alphabets

I'm new to actionscript and i cant seem to get the regex syntax right in actionscript3. The task is straight forward, i want to make sure that the first two characters in a given string are alphabets and nothing else. …

Read More
Force Garbage Collection in AS3?

Is it possible to programmatically force a full garbage collection run in ActionScript 3.0? Let's say I've created a bunch of Display objects with eventListeners and some of the DO's have been removed, some of the eventListeners have been triggered and …

Read More