ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
In any cross-domain situation, it is important to be clear about the two parties involved. For the purposes of this
discussion, the side that is performing the cross-scripting is called the accessing party (usually the accessing SWF), and
the other side is called the party being accessed (usually the SWF being accessed). When siteA.swf scripts siteB.swf,
siteA.swf is the accessing party, and siteB.swf is the party being accessed, as the following illustration shows:
SWF
siteA.com / swfA.swf
var url:String = "http://siteB.com/swfB.swf";
var req:URLRequest = new URLRequest(url);
myLoader.load(req);
myLoader.content.eggCount = 3;
myLoader.content.DisplayEggs();
cross-script
3 2 permission
Cross-domain permissions that are established with the Security.allowDomain() method are asymmetrical. In the
previous example, siteA.swf can script siteB.swf, but siteB.swf cannot script siteA.swf, because siteA.swf has not called
the Security.allowDomain() method to give SWF files at siteB.com permission to script it. You can set up
symmetrical permissions by having both SWF files call the Security.allowDomain() method.
In addition to protecting SWF files from cross-domain scripting originated by other SWF files, Flash Player protects
SWF files from cross-domain scripting originated by HTML files. HTML-to-SWF scripting can occur with callbacks
established through the ExternalInterface.addCallback() method. When HTML-to-SWF scripting crosses
domains, the SWF file being accessed must call the Security.allowDomain() method, just as when the accessing
party is a SWF file, or the operation will fail. For more information, see “Author (developer) controls” on page 1043.
Also, Flash Player provides security controls for SWF-to-HTML scripting. For more information, see “Controlling
outbound URL access” on page 1061.
Stage security
Security.allowDomain("siteA.com");
var eggCount:Number;
function DisplayEggs() { ... };
siteB.com / swfB.swf
Flash Player 9 and later, Adobe AIR 1.0 and later
Some properties and methods of the Stage object are available to any sprite or movie clip on the display list.
1
However, the Stage object is said to have an owner: the first SWF file loaded. By default, the following properties and
methods of the Stage object are available only to SWF files in the same security sandbox as the Stage owner:
load
SWF
Last updated 6/6/2012
1052