Flash and XML, Loading Data Across Domains
Wednesday, April 11th, 2007By default, Flash only allows loading of XML files found on locally due security reasons. That is, it wont let you load a file like this http://www.externaldomain.com/data.xml This can be quite an issue, since it defeats one of the purposes of using XML data, retrieval of information somewhere else (e.g. RSS) Luckily there are some solutions one of them being quite easy and it will save you countless headaches. The solutions involves creating another XML file which would reside on the server where we want to retrieve XML data or similar data and naming it "crossdomain.xml" This file must be placed on the root folder of the domain that wants to be accessed and must either allow each individual domain that tries to access it like this:
-
<?xml version="1.0"?>
-
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
-
<cross-domain-policy><allow-access-from domain="www.company.com" />
-
<allow-access-from domain="company.com" />
-
</cross-domain-policy>
or have an "allow all" rule like this:
-
<?xml version="1.0"?>
-
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
-
<cross-domain-policy>
-
<allow-access-from domain="*" />
-
</cross-domain-policy>
Allowing all domains may have some security risks so it should be used carefully.
This method works the best by far but there are also other ways to work around this issue. One involves having a dummy SWF file, referred as shim, residing on the same folder as the XML file that needs to be loaded and having it load all the XML data which then can be read by simply loading this SWF file onto your main SWF. Before it can retrieve any information you have to add some security clearance to the both of the flash files by using the security.allowDomain method:
-
//Main.swf:
-
-
System.security.allowDomain("http://www.sommexternaldomain.com");
-
-
//shim.swf:
-
-
System.security.allowDomain("http://www.maindomain.com");
The latter method involves quite a few steps so always go with the crossdomain solution.
Relevant Resources:
External data not accessible outside a Macromedia Flash movie's domain







