ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Loading data
Flash Player 9 and later, Adobe AIR 1.0 and later
Flash Player and AIR content can exchange data with servers. Loading data is a different kind of operation from
loading media, because the loaded information appears as program objects, rather than being displayed as media.
Generally, content may load data from the same domain that the content originated from. However, content usually
requires policy files in order to load data from other domains (see “Website controls (policy files)” on page 1040).
Note: Content running in the AIR application sandbox is never served from a remote domain (unless the developer
intentionally imports remote content into the application sandbox), so it cannot participate in the types of attacks that
policy files protect against. AIR content in the application sandbox is not restricted from loading data by policy files.
However, AIR content in other sandboxes is subject to the restrictions described here.
Using URLLoader and URLStream
Flash Player 9 and later, Adobe AIR 1.0 and later
You can load data, such as an XML file or a text file. The load() methods of the URLLoader and URLStream classes
are governed by URL policy file permissions.
If you use the load() method to load content from a domain other than that of the code that is calling the method,
the runtime checks for a URL policy file on the server of the loaded assets. If there is a policy file, and it grants access
to the domain of the loading content, you can load the data.
Connecting to sockets
Flash Player 9 and later, Adobe AIR 1.0 and later
By default, the runtime looks for a socket policy file served from port 843. As with URL policy files, this file is called
the master policy file.
When policy files were first introduced in Flash Player 6, there was no support for socket policy files. Connections to
socket servers were authorized by a policy file in the default location on an HTTP server on port 80 of the same host
as the socket server. Flash Player 9 still supports this capability, but Flash Player 10 does not. In Flash Player 10, only
socket policy files can authorize socket connections.
Like URL policy files, socket policy files support a meta-policy statement that specifies which ports can serve policy
files. However, instead of “master-only,” the default meta-policy for socket policy files is “all.” That is, unless the
master policy file specifies a more restrictive setting, Flash Player assumes that any socket on the host can serve a socket
policy file.
Access to socket and XML socket connections is disabled by default, even if the socket you are connecting to is in the
same domain as the SWF file. You can permit socket-level access by serving a socket policy file from any of the
following locations:
Port 843 (the location of the master policy file)
The same port as the main socket connection
A different port than the main socket connection
By default, Flash Player looks for a socket policy file on port 843 and on the same port as the main socket connection.
If you want to serve a socket policy file from a different port, the SWF file must call Security.loadPolicyFile().
Last updated 6/6/2012
1057