ActionScript 2.0 Language Reference - Adobe Help and Support

■ Support has been added for wildcard values with System.security.allowDomain("*")
and System.security.allowInsecureDomain("*"). The wildcard (*) value permits
cross-scripting operations where the accessing file is any file at all, loaded from anywhere.
Think of the wildcard as a global permission. Wildcard permissions can be useful in
general, and in particular they are required to enable certain kinds of operations under the
new local file security rules in Flash Player 8. Specifically, for a local SWF file with
network-access permissions to script a SWF file on the Internet, the Internet SWF file
being accessed must call System.security.allowDomain("*"), reflecting that the origin
of a local SWF file is unknown. (If the Internet SWF file being accessed is loaded from an
HTTPS URL, the Internet SWF file must instead call
System.security.allowInsecureDomain("*").)
Occasionally, you may encounter the following situation: You load a child SWF file from a
different domain and want to allow the child SWF file to script the parent SWF file, but you
don't know the final domain from which the child SWF file will come. This can happen, for
example, when you use load-balancing redirects or third-party servers.
In this situation, you can use the MovieClip._url property as a parameter to this method.
For example, if you load a SWF file into the movie clip my_mc, you can call
System.security.allowDomain(my_mc._url). If you do this, be sure to wait until the
SWF file in my_mc begins loading, because the _url property does not have its final, correct
value until this time. The best way to determine when a child SWF file has begun loading is
to use MovieClipLoader.onLoadStart.
The opposite situation can also occur; that is, you might create a child SWF file that wants to
allow its parent to script it, but doesn't know what the domain of its parent will be. In this
situation, call System.security.allowDomain(_parent._url) from the child SWF. You
don't have to wait for the parent SWF file to load; the parent will already be loaded by the
time the child loads.
If you are publishing for Flash Player 8, you can also handle these situations by calling
System.security.allowDomain("*"). However, this can sometimes be a dangerous
shortcut, because it allows the calling SWF file to be accessed by any other SWF file from any
domain. It is usually safer to use the _url property.
For more information, see the following:
■ The Flash Player 9 Security white paper at http://www.adobe.com/go/fp9_0_security
■ The Flash Player 8 Security-Related API white paper at http://www.adobe.com/go/
fp8_security_apis
Availability: ActionScript 1.0; Flash Player 6 - Behavior changed in Flash Player 7; behavior
changed in Flash Player 8.
security (System.security) 1075