ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Master policy files
Flash Player 9 and later, Adobe AIR 1.0 and later
By default, Flash Player (and AIR content that is not in the AIR application sandbox) first looks for a URL policy file
named crossdomain.xml in the root directory of the server, and looks for a socket policy file on port 843. A file in
either of these locations is called the master policy file. (In the case of socket connections, Flash Player also looks for a
socket policy file on the same port as the main connection. However, a policy file found on that port is not considered
a master policy file.)
In addition to specifying access permissions, the master policy file can also contain a meta-policy statement. A metapolicy
specifies which locations can contain policy files. The default meta-policy for URL policy files is “master-only,”
which means that /crossdomain.xml is the only policy file allowed on the server. The default meta-policy for socket
policy files is “all,” which means that any socket on the host can serve a socket policy file.
Note: In Flash Player 9 and earlier, the default meta-policy for URL policy files was “all,” which means that any directory
can contain a policy file. If you have deployed applications that load policy files from locations other than the default
/crossdomain.xml file, and those applications might now be running in Flash Player 10, make sure you (or the server
administrator) modify the master policy file to allow additional policy files. For information on how to specify different
a different meta-policy, see the Flash Player Developer Center topic “Policy File Changes in Flash Player 9” at
www.adobe.com/go/devnet_security_en.
A SWF file can check for a different policy filename or a different directory location by calling the
Security.loadPolicyFile() method. However, if the master policy file doesn’t specify that the target location can
serve policy files, the call to loadPolicyFile() has no effect, even if there is a policy file at that location. Call
loadPolicyFile() before attempting any network operations that require the policy file. Flash Player automatically
queues networking requests behind their corresponding policy file attempts. So, for example, it is acceptable to call
Security.loadPolicyFile() immediately before initiating a networking operation.
When checking for a master policy file, Flash Player waits three seconds for a server response. If a response isn’t
received, Flash Player assumes that no master policy file exists. However, there is no default timeout value for calls to
loadPolicyFile(); Flash Player assumes that the file being called exists, and waits as long as necessary to load it.
Therefore, if you want to make sure that a master policy file is loaded, use loadPolicyFile() to call it explicitly.
Even though the method is named Security.loadPolicyFile(), a policy file isn’t loaded until a network call that
requires a policy file is issued. Calls to loadPolicyFile() simply tell Flash Player where to look for policy files when
they are needed.
You can’t receive notification of when a policy file request is initiated or completed, and there is no reason to do so.
Flash Player performs policy checks asynchronously, and automatically waits to initiate connections until after the
policy file checks have succeeded.
The following sections contain information that applies only to URL policy files. For more information on socket
policy files, see “Connecting to sockets” on page 1057.
URL policy file scope
Flash Player 9 and later, Adobe AIR 1.0 and later
A URL policy file applies only to the directory from which it is loaded and to its child directories. A policy file in the
root directory applies to the whole server; a policy file loaded from an arbitrary subdirectory applies only to that
directory and its subdirectories.
Last updated 6/6/2012
1041