Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>Summary</strong></p> <p>Add <code>crossdomain.xml</code> to each CDN host or adopt to limited <code>Sound</code> functionality.</p> <p><strong>Details</strong></p> <ol> <li><p><a href="http://help.adobe.com/en_US/as3/dev/WS5b3ccc516d4fbf351e63e3d118a9b90204-7e3f.html#WS5b3ccc516d4fbf351e63e3d118a9b90204-7c8f" rel="nofollow">SWF files that are assigned to the local-trusted sandbox can interact with any other SWF files and can load data from anywhere (remote or local).</a></p></li> <li><p><code>Sound</code> can load stuff from other domains <a href="http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/media/Sound.html" rel="nofollow">that don't allow access using cross-domain policy with certain restrictions</a>:</p> <blockquote> <p>Certain operations dealing with sound are restricted. The data in a loaded sound cannot be accessed by a file in a different domain unless you implement a cross-domain policy file. Sound-related APIs that fall under this restriction are Sound.id3, SoundMixer.computeSpectrum(), SoundMixer.bufferTime, and the SoundTransform class.</p> </blockquote></li> <li><p>Flash in general has pretty <a href="http://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/CrossDomain_PolicyFile_Specification.pdf" rel="nofollow">complex cross-domain policies</a> but in your case the bottom line is that you'll need to have proper <code>crossdmain.xml</code> on each host except the one that serves the SWF:</p> <p>3.1. If your file is served from <code>http://resource.domain.com</code> it's not required to have <code>http://resource.domain.com/crossdomain.xml</code> but it's <a href="http://kachurovskiy.com/2013/flash-security-at-the-end-of-flash-era/" rel="nofollow">really good to have one</a>.</p> <p>3.2. You will need to have proper <code>http://dyn2.domain.com/crossdomain.xml</code> explicitly allowing your SWF to access <code>dyn2.domain.com</code> to be able to use <code>URLLoader</code> and other APIs that provide access to raw loaded data. </p> <p>3.3. There's a reason for these restrictions - cookies (and other ambient user credentials). If Flash would not require proper cross-domains after a redirect, one could access any domain with user cookies attached by simply loading his own redirector first. <a href="http://kachurovskiy.com/2013/flash-security-at-the-end-of-flash-era/" rel="nofollow">This means accessing all user cookie-protected data (e.g. mail.google.com) from any SWF on the internet that's running in your browser.</a></p></li> </ol>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload