Flash 8 Documentation

Learning ActionScript 2.0 in Flash > Understanding Security > About domains, cross-domain security, and SWF files

About domains, cross-domain security, and SWF files

By default, Flash Player 7 and later versions prevent a SWF file served from one domain from reading data, objects, or variables from SWF files that are served from different domains. In addition, content that is loaded through nonsecure (non-HTTPS) protocols cannot read content loaded through a secure (HTTPS) protocol, even when both are in exactly the same domain. For example, a SWF file located at http://www.macromedia.com/main.swf cannot load data from https://www.macromedia.com/data.txt without explicit permission; neither can a SWF file served from one domain load data (using loadVars(), for example) from another domain.

Identical numeric IP addresses are compatible. However, a domain name is not compatible with an IP address, even if the domain name resolves to the same IP address.

The following table shows examples of compatible domains:

The following table shows examples of incompatible domains:

Flash Player 8 does not allow local SWF files to communicate with the Internet without a proper configuration. For information on setting up a configuration file to test content locally, see Creating configuration files for Flash development.

For more information on security, see www.macromedia.com/devnet/security/ and www.macromedia.com/software/flashplayer/security/.

For more information, see the following topics:

• Domain name rules for settings and local data
• Cross-domain and subdomain access between SWF files
• Allowing cross-domain data loading

Version 8

Send me an e-mail when comments are added to this page | Comment Report

Current page: http://livedocs.adobe.com/flash/8/main/00001616.html

Add Comment