ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
The primary purpose of calling the Security.allowDomain() method is to grant permission for SWF files in an
outside domain to script the SWF file calling the Security.allowDomain() method. For more information, see
“Cross-scripting” on page 1051.
Specifying an IP address as a parameter to the Security.allowDomain() method does not permit access by all parties
that originate at the specified IP address. Instead, it permits access only by a party that contains the specified IP address
as its URL, rather than a domain name that maps to that IP address. For example, if the domain name
www.example.com maps to the IP address 192.0.34.166, a call to Security.allowDomain("192.0.34.166") does
not grant access to www.example.com.
You can pass the "*" wildcard to the Security.allowDomain() method to allow access from all domains. Because it
grants permission for SWF files from all domains to script the calling SWF file, use the "*" wildcard with care.
ActionScript includes a second permission API, called Security.allowInsecureDomain(). This method does the
same thing as the Security.allowDomain() method, except that, when called from a SWF file served by a secure
HTTPS connection, it additionally permits access to the calling SWF file by other SWF files that are served from an
insecure protocol, such as HTTP. However, it is not a good security practice to allow scripting between files from a
secure protocol (HTTPS) and those from insecure protocols (such as HTTP); doing so can open secure content to
snooping and spoofing attacks. Here is how such attacks can work: since the Security.allowInsecureDomain()
method allows access to your secure HTTPS data by SWF files served over HTTP connections, an attacker interposed
between your HTTP server and your users could replace your HTTP SWF file with one of their own, which can then
access your HTTPS data.
Important: Code executing in the AIR application sandbox is not permitted to call either the allowDomain() or
allowInsecureDomain() methods of the Security class.
Another important security-related method is the Security.loadPolicyFile() method, which causes Flash Player
to check for a policy file at a nonstandard location. For more information, see “Website controls (policy files)” on
page 1040.
Restricting networking APIs
Flash Player 9 and later, Adobe AIR 1.0 and later
Networking APIs can be restricted in two ways. To prevent malicious activity, access to commonly reserved ports is
blocked; you can’t override these blocks in your code. To control a SWF file’s access to network functionality with
regard to other ports, you can use the allowNetworking setting.
Blocked ports
Flash Player 9 and later, Adobe AIR 1.0 and later
Flash Player and Adobe AIR have restrictions on HTTP access to certain ports, as do browsers. HTTP requests are not
permitted to certain standard ports that are conventionally used for non-HTTP types of servers.
Any API that accesses a network URL is subject to these port blocking restrictions. The only exception is APIs that call
sockets directly, such as Socket.connect() and XMLSocket.connect(), or calls to Security.loadPolicyFile()
in which a socket policy file is being loaded. Socket connections are permitted or denied through the use of socket
policy files on the target server.
The following list shows the ActionScript 3.0 APIs to which port blocking applies:
Last updated 6/6/2012
1044