Flash Player Security

The Flash Player includes a security feature that does not allow scripts to be read across domains. It also does not recognize two URLs for the same site, with and without "www", as being on the same domain. For example, http://www.yourdomain.com or not recognized as being the same as http://yourdomain.com

If you chose to specify a full URL in the "path to script" property of the flashGuestbook component, for example http://www.yourdomain.com/guestbook/, and your guestbook is accessed by the URL http://yourdomain.com, a security message will appear from the Flash Player, asking to verifying the transfer of data or the data may simply not be submitted.

The solution that Adobe have is to create a crossdomain.xml policy file on your webserver. This is how you would create it:

 

1. Open a new document in a text editor, such as Notepad.


2. Paste the following code into the document:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="yourdomain.com" />
</cross-domain-policy>

 

3. Change "yourdomain.com" with your own domain, without the "www".


4. Save this file under the name: crossdomain.xml


5. Upload this file to the root of your webserver (usually the same place where the HTML files reside).


You can now specify the URL of the scripts as being http://www.yourdomain.com/guestbook/ and you will not receive any pop-up warnings when accessing the URL without the "www".

For more information on the cross-domain policy file, please see the following Macromedia article:
http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_14213&sliceId=2