ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
A socket policy file has the same syntax as a URL policy file, except that it must also specify the ports to which it grants
access. When a socket policy file is served from a port number below 1024, it may grant access to any ports; when a
policy file comes from port 1024 or higher, it may grant access only to ports 1024 and higher. The allowed ports are
specified in a to-ports attribute in the tag. Single port numbers, port ranges, and wildcards
are accepted values.
Here is an example socket policy file:
To retrieve a socket policy file from port 843 or from the same port as a main socket connection, call the
Socket.connect() or XMLSocket.connect() method. Flash Player first checks for a master policy file on port 843.
If it finds one, it checks to see if the file contains a meta-policy statement that prohibits socket policy files on the target
port. If access isn’t prohibited, Flash Player first looks for the appropriate allow-access-from statement in the
master policy file. If it doesn’t find one, it then looks for a socket policy file on the same port as the main socket
connection.
To retrieve a socket policy file a different location, first call the Security.loadPolicyFile() method with the special
"xmlsocket" syntax, as in the following:
Security.loadPolicyFile("xmlsocket://server.com:2525");
Call the Security.loadPolicyFile() method before calling the Socket.connect() or XMLSocket.connect()
method. Flash Player then waits until it has fulfilled your policy file request before deciding whether to allow your main
connection. However, if the master policy file specifies that the target location can’t serve policy files, the call to
loadPolicyFile() has no effect, even if there is a policy file at that location.
If you are implementing a socket server and you need to provide a socket policy file, decide whether to provide the
policy file using the same port that accepts main connections, or using a different port. In either case, your server must
wait for the first transmission from your client before sending a response.
When Flash Player requests a policy file, it always transmits the following string as soon as a connection is established:
Once the server receives this string, it can transmit the policy file. The request from Flash Player is always terminated
by a null byte, and the response from the server must also be terminated by a null byte.
Do not expect to reuse the same connection for both a policy file request and a main connection; close the connection
after transmitting the policy file. If you do not, Flash Player closes the policy file connection before reconnecting to set
up the main connection.
Last updated 6/6/2012
1058