ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
For more information
Flash Player 9 and later, Adobe AIR 1.0 and later
For more information on outbound URL access, see the following entries in the ActionScript 3.0 Reference for the
Adobe Flash Platform:
The flash.system.fscommand() function
The call() method of the ExternalInterface class
The flash.net.navigateToURL() function
Shared objects
Flash Player 9 and later, Adobe AIR 1.0 and later
Flash Player provides the ability to use shared objects, which are ActionScript objects that persist outside of a SWF file,
either locally on a user’s file system or remotely on an RTMP server. Shared objects, like other media in Flash Player,
are partitioned into security sandboxes. However, the sandbox model for shared objects is somewhat different, because
shared objects are not resources that can ever be accessed across domain boundaries. Instead, shared objects are always
retrieved from a shared object store that is particular to the domain of each SWF file that calls methods of the
SharedObject class. Usually a shared object store is even more particular than a SWF file’s domain: by default, each
SWF file uses a shared object store particular to its entire origin URL. For more information on shared objects, see
“Shared objects” on page 700.
A SWF file can use the localPath parameter of the SharedObject.getLocal() and SharedObject.getRemote()
methods to use a shared object store associated with only a part of its URL. In this way, the SWF file can permit sharing
with other SWF files from other URLs. Even if you pass '/' as the localPath parameter, this still specifies a shared
object store particular to its own domain.
Users can restrict shared object access by using the Flash Player Settings dialog box or the Settings Manager. By default,
shared objects can be created up to a maximum of 100 KB of data per domain. Administrative users and users can also
place restrictions on the ability to write to the file system. For more information, see “Administrator controls” on
page 1037 and “User controls” on page 1039.
You can specify that a shared object is secure, by specifying true for the secure parameter of the
SharedObject.getLocal() method or the SharedObject.getRemote() method. Note the following about the
secure parameter:
If this parameter is set to true, Flash Player creates a new secure shared object or gets a reference to an existing
secure shared object. This secure shared object can be read from or written to only by SWF files delivered over
HTTPS that call SharedObject.getLocal() with the secure parameter set to true.
If this parameter is set to false, Flash Player creates a new shared object or gets a reference to an existing shared
object that can be read from or written to by SWF files delivered over non-HTTPS connections.
If the calling SWF file is not from an HTTPS URL, specifying true for the secure parameter of the
SharedObject.getLocal() method or the SharedObject.getRemote() method results in a SecurityError
exception.
Last updated 6/6/2012
1063