ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Setting LocalConnection permissions
Flash Player 9 and later, Adobe AIR 1.0 and later
The LocalConnection class lets you send messages between one Flash Player or AIR application and another.
LocalConnection objects can communicate only among Flash Player or AIR content running on the same client
computer, but they can be running in different applications—for example, a SWF file running in a browser, a SWF file
running in a projector, and an AIR application can all communicate use the LocalConnection class.
For every LocalConnection communication, there is a sender and a listener. By default, Flash Player allows
LocalConnection communication between code running in the same domain. For code running in different
sandboxes, the listener must allow the sender permission by using the LocalConnection.allowDomain() method.
The string you pass as an argument to the LocalConnection.allowDomain() method can contain any of the
following: exact domain names, IP addresses, and the * wildcard.
The allowDomain() method has changed from the form it had in ActionScript 1.0 and 2.0. In those earlier versions,
allowDomain() was a callback method that you implemented. In ActionScript 3.0, allowDomain() is a built-in
method of the LocalConnection class that you call. With this change, allowDomain() works in much the same way as
Security.allowDomain().
A SWF file can use the domain property of the LocalConnection class to determine its domain.
Controlling outbound URL access
Flash Player 9 and later, Adobe AIR 1.0 and later
Outbound scripting and URL access (through the use of HTTP URLs, mailto: and so on) are achieved through use of
the following APIs:
The flash.system.fscommand() function
The ExternalInterface.call() method
The flash.net.navigateToURL() function
For content loaded from the local file system, calls to these methods are successful only if the code and the containing
web page (if there is one) are in the local-trusted or AIR application security sandboxes. Calls to these methods fail if
the content is in the local-with-networking or local-with-filesystem sandbox.
For content that is not loaded locally, all of these APIs can communicate with the web page in which they are
embedded, depending on the value of the AllowScriptAccess parameter described below. The
flash.net.navigateToURL() function has the additional ability to communicate with any open browser window or
frame, not just the page in which the SWF file is embedded. For more information on this functionality, see “Using the
navigateToURL() function” on page 1062.
The AllowScriptAccess parameter in the HTML code that loads a SWF file controls the ability to perform outbound
URL access from within the SWF file. Set this parameter inside the PARAM or EMBED tag. If no value is set for
AllowScriptAccess, the SWF file and the HTML page can communicate only if both are from the same domain.
The AllowScriptAccess parameter can have one of three possible values: "always", "sameDomain", or "never".
When AllowScriptAccess is "always", the SWF file can communicate with the HTML page in which it is
embedded even when the SWF file is from a different domain than the HTML page.
Last updated 6/6/2012
1061