Important security note

The Flash Player 7 and 8 includes an additional security feature that does not allow scripts to be read across domains. It also does not recognize two URLs for the same site, with and without www, as being on the same domain. For example, http://www.yourdomain.com is not recognized as being the same as http://yourdomain.com

If you specified a full URL in the fCMS Server Path property of the CMSMaster component, for example http://www.yourdomain.com/fCMSBackend/, and your site is accessed by the URL http://yourdomain.com, a security message will appear from the Flash Player, asking to verifying the transfer of data. In some cases, the XML may fail to load.

 

There are two security measures, both of which must be implemented. These are the instructions for implementing the first solution:

1. Ensure that the fCMS Server Path property includes the URL to your fCMSBackend with the www, for example: http://www.yourdomain.com/fCMSBackend/

 

2. Add the following line of ActionScript to the first frame of your movie (replacing yourdomain.com with the domain of your website without the www):

System.security.allowDomain("yourdomain.com");

 

The second solution is to create a crossdomain.xml policy file on your webserver.

 

How to create a crossdomain.xml file
1. Open a new document in a text editor, such as Notepad.


2. Paste the following code into the document:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="yourdomain.com" />
</cross-domain-policy>

3. Replace yourdomain.com with your own domain, without the www.

 

4. Save this file under the name: crossdomain.xml

 

5. Upload this file to the root of your webserver (usually the same place where the HTML files reside).


You can now specify the URL of the fCMSBackend as being http://www.yourdomain.com/fCMSBackend/ and you will not receive any pop-up warnings when accessing the URL without the www.

For more information on the cross-domain policy file, please see the following Macromedia article:
http://www.macromedia.com/support/flash/ts/documents/loadvars_security.htm