ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Protecting data
Flash Player 9 and later, Adobe AIR 1.0 and later
To protect data from eavesdropping and alteration as it travels over the Internet, you can use the Transport Layer
Security (TLS) or Socket Layer Security (SSL) on the server where the data originates. You can then connect to the
server using the HTTPS protocol.
In applications created for AIR 2 or above, you can also protect TCP socket communications. The SecureSocket class
allows you to initiate a socket connection to a socket server that uses TLS version 1or SSL version 4.
Sending data
Flash Player 9 and later, Adobe AIR 1.0 and later
Data sending occurs when code sends data to a server or resource. Sending data is always permitted for content from
a network domain. A local SWF file can send data to network addresses only if it is in the local-trusted, local-withnetworking,
or AIR application sandbox. For more information, see “Local sandboxes” on page 1033.
You can use the flash.net.sendToURL() function to send data to a URL. Other methods also send requests to URLs.
These include loading methods, such as Loader.load() and Sound.load(), and data-loading methods, such as
URLLoader.load() and URLStream.load().
Uploading and downloading files
Flash Player 9 and later, Adobe AIR 1.0 and later
The FileReference.upload() method starts the upload of a file selected by a user to a remote server. You must call
the FileReference.browse() or FileReferenceList.browse() method before calling the
FileReference.upload() method.
The code that initiates the FileReference.browse() or FileReferenceList.browse() method can be called only
in response to a mouse event or keyboard event. If it is called in other situations, Flash Player 10 and later throws an
exception. However, a user-initiated event is not required to call these methods from the AIR application sandbox.
Calling the FileReference.download() method opens a dialog box in which the user can download a file from a
remote server.
Note: If your server requires user authentication, only SWF files running in a browser—that is, using the browser plugin
or ActiveX control—can provide a dialog box to prompt the user for a user name and password for authentication, and
only for downloads. Flash Player does not allow uploads to a server that requires user authentication.
Uploads and downloads are not allowed if the calling SWF file is in the local-with-filesystem sandbox.
By default, a SWF file may not initiate an upload to, or a download from, a server other than its own. A SWF file may
upload to, or download from, a different server if that server provides a policy file that grants permission to the domain
of the invoking SWF file.
Last updated 6/6/2012
1059