ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Loading embedded content from SWF files imported
into a security domain
Flash Player 9 and later, Adobe AIR 1.0 and later
When you load a SWF file, you can set the context parameter of the load() method of the Loader object that is used
to load the file. This parameter takes a LoaderContext object. When you set the securityDomain property of this
LoaderContext object to Security.currentDomain, Flash Player checks for a URL policy file on the server of the
loaded SWF file. If there is a policy file, and it grants access to the domain of the loading SWF file, you can load the
SWF file as imported media. In this way, the loading file can get access to objects in the library of the SWF file.
An alternative way for a SWF file to access classes in loaded SWF files from a different security sandbox is to have the
loaded SWF file call the Security.allowDomain() method to grant access to the domain of the calling SWF file. You
can add the call to the Security.allowDomain() method to the constructor method of the main class of the loaded
SWF file, and then have the loading SWF file add an event listener to respond to the init event dispatched by the
contentLoaderInfo property of the Loader object. When this event is dispatched, the loaded SWF file has called the
Security.allowDomain() method in the constructor method, and classes in the loaded SWF file are available to the
loading SWF file. The loading SWF file can retrieve classes from the loaded SWF file by calling
Loader.contentLoaderInfo.applicationDomain.getDefinition() or
Loader.contentLoaderInfo.applicationDomain.getQualifiedDefinitionNames()(Flash Player 11.3 and higher; AIR 3.3
and higher).
Working with legacy content
Flash Player 9 and later, Adobe AIR 1.0 and later
In Flash Player 6, the domain that is used for certain Flash Player settings is based on the trailing portion of the domain
of the SWF file. These settings include settings for camera and microphone permissions, storage quotas, and storage
of persistent shared objects.
If the domain of a SWF file includes more than two segments, such as www.example.com, the first segment of the
domain (www) is removed, and the remaining portion of the domain is used. So, in Flash Player 6, www.example.com
and store.example.com both use example.com as the domain for these settings. Similarly, www.example.co.uk and
store.example.co.uk both use example.co.uk as the domain for these settings. This can lead to problems in which SWF
files from unrelated domains, such as example1.co.uk and example2.co.uk, have access to the same shared objects.
In Flash Player 7 and later, player settings are chosen by default according to a SWF file’s exact domain. For example,
a SWF file from www.example.com would use the player settings for www.example.com. A SWF file from
store.example.com would use the separate player settings for store.example.com.
In a SWF file written using ActionScript 3.0, when Security.exactSettings is set to true (the default), Flash Player
uses exact domains for player settings. When it is set to false, Flash Player uses the domain settings used in Flash
Player 6. If you change exactSettings from its default value, you must do so before any events occur that require
Flash Player to choose player settings—for example, using a camera or microphone, or retrieving a persistent shared
object.
If you published a version 6 SWF file and created persistent shared objects from it, to retrieve those persistent shared
objects from a SWF that uses ActionScript 3.0, you must set Security.exactSettings to false before calling
SharedObject.getLocal().
Last updated 6/6/2012
1060