ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Another element you can use to permit access is the allow-http-request-headers-from tag. This element grants
a client hosting content from another permission domain to send user-defined headers to your domain. While the
tag grants other domains permission to pull data from your domain, the allow-httprequest-headers-from
tag grants other domains permission to push data to your domain, in the form of headers.
In the following example, any domain is permitted to send the SOAPAction header to the current domain:
If the allow-http-request-headers-from statement is in the master policy file, it applies to all directories on the
host. Otherwise, it applies only to the directory and subdirectories of the policy file that contains the statement.
Preloading policy files
Flash Player 9 and later, Adobe AIR 1.0 and later
Loading data from a server or connecting to a socket is an asynchronous operation. Flash Player simply waits for the
policy file to finish downloading before it begins the main operation. However, extracting pixel data from images or
extracting sample data from sounds is a synchronous operation. The policy file must load before you can extract data.
When you load the media, specify that it check for a policy file:
When using the Loader.load() method, set the checkPolicyFile property of the context parameter, which is
a LoaderContext object.
When embedding an image in a text field using the tag, set the checkPolicyFile attribute of the tag
to "true", as in the following:
When using the Sound.load() method, set the checkPolicyFile property of the context parameter, which is a
SoundLoaderContext object.
When using the NetStream class, set the checkPolicyFile property of the NetStream object.
When you set one of these parameters, Flash Player first checks for any policy files that it already has downloaded for
that domain. Then it looks for the policy file in the default location on the server, checking both for
statements and for the presence of a meta-policy. Finally, it considers any pending calls to the
Security.loadPolicyFile() method to see if they are in scope.
Author (developer) controls
Flash Player 9 and later, Adobe AIR 1.0 and later
The main ActionScript API used to grant security privileges is the Security.allowDomain() method, which grant
privileges to SWF files in the domains that you specify. In the following example, a SWF file grants access to SWF files
served from the www.example.com domain:
Security.allowDomain("www.example.com")
This method grants permissions for the following:
Cross-scripting between SWF files (see “Cross-scripting” on page 1051)
Display list access (see “Traversing the display list” on page 1053)
Event detection (see “Event security” on page 1054)
Full access to properties and methods of the Stage object (see “Stage security” on page 1052)
Last updated 6/6/2012
1043