Cross-domain issue

I've developed a Flex application for a while, using HTTPService to GET XML objects to and remote XML MESSAGE to a web service.  Don't launch the application on my local machine, I had no security problems.  However, I just wore the first instance of the application on our server and I started getting security errors (faultString = "Security error to go to the url", faultDetail = ' Destination: DefaultHTTP "").

I'm sure that there is a problem between the areas, and I'm communicating with those responsible for the server to get a security policy file that is added to the root of the server.  When I was communicating with them, however, I could not explain clearly why they the server due to add a policy file security for what is mainly a problem of the client security.

  • Am I right that it is a cross-domain issue?
  • Why did I have not this error when I spear the app of my file system?
  • Why is the server responsible for security rather than the client policies?

Thank you.

I think that is the point of having a crossdomain file, so nobody can take your SWF, the hack file and mess with their data.

If you are into Flex Builder, you create the SWF file.

Once its on the web, the crossdomain file protects the data and your SWF of piracy.

If this post answers your question or assistance, please mark it as such.

Tags: Flex

Similar Questions

  • Cross domain AJAX calls work on browser, but not on ripple/Simulator

    The question I faced is I call of cross-domain ajax using jQuery for the facebook site using an access token. This call works on Chrome and Firefox, but fails on the Simulator and ripple. I have setup my file config.xml with the proper access flags.

    My related code is below (cut).

    var fbData = { access_token: _fbToken };
    var fbUrl = "https://graph.facebook.com/me";
    
    $.getJSON(fbUrl,fbData, function(data){
       // Some code here
    });
    

    I also tried using the extended method of $. ajax() and JSONP specifying the data type, but it is the same problem.

    I looked in the Inspector on the drive and I see that no host header is set, but Chrome or Firefox will automatically fill "Host: graph.facebook.com" in the request header. I wonder if this is the problem?

    Demand is just stuck as 'pending' in the network tab.

    JSONP requests in jQuery, you cannot alter the headers (so not in available beforeSend setHeader).

    I don't have the chance to test it on the device but wonder if other people have faced this problem.

    Well, for those who falls on this issue, the problem does not occur on the device (AFAIK). I ran on a device OS6 and things were good to go.

  • using modules in json (or enabling cross domain ajax) files

    I need to display a list of web applications on a different domain. (Both are catalyst for activity sites).

    I seem to have two options:

    JSONP

    I jsonp working on a json file coded hardcoded, but as soon as I tried to put the {module_webapps} in, I realized that BC does not have labels outside of the html files.

    This is the json file, I want to get:

    () houseLandCallback

    {"packages": []}

    {module_webapps, 7307, c, 48029}

    ]}

    );

    CROSS DOMAIN AJAX

    Is it possible to allow both sites to BC to share data?

    I know that the whole point of British Colombia is it have a solid server that you cannot change.

    Not at the moment no. You can run out of FEED.

    Liquid and BC. Is then on the horizon that has more support JSON, etc., while JSOP is not at launch, if all goes well, it can be added down the line.

  • load the XML file field Companion without cross-domain policy file

    Hello.

    Assuming that there are two areas companions on the same server: /public_html/domain1.com and /public_html/domain2.com

    I'm trying to load the XML from domain2.com in domain1.com without using a cross-domain policy file (since it does not work with xml files in my case).

    So the idea is to use a php file to load XML and read it back to Flash.

    I found an interesting scripts that seems to do the job, but unfortunately I can't make it work. In my opinion, there is somewhere with AS3 part problem. Please take a look.

    Here's the AS3/PHP scripts:

    AS3 (.swf in www.domain1.com):

    location of the xml file you want to load, full http address

    var xmlLoc:String = " " http://www.Domain2.com/MyFile.XML ";

    location of the php xml grabber, regarding the .swf

    var phpLoc:String = "loadXML.php";

    var xml;

    var loader: URLLoader = new URLLoader();

    var request: URLRequest = new URLRequest (phpLoc + "? location =" + escape (xmlLoc));

    loader.addEventListener (Event.COMPLETE, onXMLLoaded);

    loader.addEventListener (IOErrorEvent.IO_ERROR, onIOErrorHandler);

    Loader.Load (request);

    function onIOErrorHandler(e:IOErrorEvent):void {}

    trace ("there was an error with the xml file" + e);

    }

    function onXMLLoaded(e:Event):void {}

    trace ("RSS feed has been loaded");

    XML = new XML (loader.data);

    / / string value, because it is passed from php as object

    XML = XML (xml.toString ());

    xml_txt.text = xml;

    }

    PHP (loadXML.php to www.domain1.com):

    <? PHP

    Header ("Content-type: text/xml");

    $location = "";

    {if (isset($_GET["location"]))}

    $location = $_GET ['location'];

    $location = urldecode ($location);

    }

    $xml_string = getData ($location);

    return the url encoded Flash vars

    echo $xml_string;

    Loops of a URL and returns

    function getData ($query) {}

    / / create resource curl

    $ch = function curl_init();

    / / cURL url

    curl_setopt ($ch, CURLOPT_URL, $query);

    Set some required params for the use of CURL

    curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, false);

    curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);

    Execute the loop works and decode the returned JSON data

    $result = curl_exec;

    return $result;

    / / Close the curl resource to free up system resources

    curl_close ($ch);

    }

    ? >

    I think you might be right about / permissions on the server for php settings. Unfortunately I'm not allowed to adjust.

    So I wrote my own script - this time I used the path instead of the http address of the XML file.  It works fine in my case.

    Here it is:

    XML file on domain2.com:

    SWF on domain1.com:

    var imagesXML:XML;

    var variables: URLVariables = new URLVariables();

    var varURL:URLRequest = new URLRequest ("MyPHPfile.php");

    varURL.method = URLRequestMethod.POST;

    variable = varURL.data;

    var MyLoader:URLLoader = new URLLoader;

    MyLoader.dataFormat = pouvez;

    MyLoader.addEventListener (Event.COMPLETE, XMLDone);

    MyLoader.load (varURL);

    function XMLDone(event:Event):void {}

    var imported_XML:Object = event.target.data.imported_XML;

    imagesXML = new XML (imported_XML);

    MyTextfield_1.text = imagesXML;

    MyTextfield_2.text = imagesXML.image [0] .attribute ("thumbPath");  reference sample to assign "thumbPath' of the first item

    }

    php on domain1.comfile:

    <>

    $xml_file = simplexml_load_file('.. /.. / /galleries/gallery_1/MyXMLfile.xmldomain2.com');  Directory of XML file on the same server

    $imported_XML = $xml_file-> asXML();

    Print "imported_XML =". $imported_XML;

    ?>

    Concerning

    PS: for those who have read the foregoing: the first and the second script works but you need to test which one is best for your situation. The first script will work also between two domains located on different servers. No. cross necessary domain policy file.

  • Is this multidomain or cross domain SSO?

    Hi all

    There are two servers in the intranet.

    Server1.test.NET
    Server2.test.com

    So we have areas cookie: test.net & test.com.

    There are several areas SSO or cross domain SSO?

    Thank you

    Published by: 859875 on May 27, 2011 06:57

    Hello

    It's okay... people usually merges between these two. However, it's not his fault so many books and online references also count them in the same compartment. His words using the correct terminology.

    With your question, test.net and test.com will be the example of sso multdomain in most cases with quite obvious reason that for most, both are in the same intranet.
    The choice is still flexible, if it isn't within the intranet and reckoned to cross the field (However, this case is quite rare).

    Yet once, multi domain and cross terminologies of the field are against the logical concepts and not fixed with examples. You could make that your decision based on your example.

    Hope this helps,

  • Cross-Domain problem

    I'm having a problem with some pictures of the area that I'm loading in Flash. I have all subdomains of the calling area (e.g. "*.") sitewithswf.com') in the policy file cross-domain in the domain that hosts the images I am trying to load in the root. I use Charles to check that all load in properly. The crossdomain.xml file from the domain that hosts the images IS to take and it contain the field making call (well well, with characters generic subdomain) and I even see the image is also getting Charles requested and returned through, as well as a response to "200" for the load HTTP_STATUS. However, my COMPLETE function is never called. I wrapped the load() with a try and it does not fail, and my IO_ERROR is not called. If for some reason, all the world is OK with my SWF get these images, but the COMPLETE is never called. Any ideas?

    You are welcome.

  • cross-domain-policy does not work

    I get an error message:

    Error #2048: security sandbox violation: http://www.m.com/p/bin-debug/main.swf Cannot load data from http://rateservice.m.com/rateservice.svc/ .

    My cross-domain file to http://rateservice.m.com is :

    <?xml version="1.0"?>
    <!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
    <cross-domain-policy>
    <allow-access-from domain="*.m.com"/>
    </cross-domain-policy>

    using m as alias

    Please tell us how do I solve this problem, as it should work. I did a test of firbug and the cross domain is to be found by the eyelashes of firebug

    1. There is no closing tag:

    http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"/>
    
  • Cross-domain SWF problem

    Goal
    My main SWF (let's call it "TheShell.SWF") needs to load another SWF (call it a "TheContent.SWF") using loadMovie cross-domain.

    Problem
    I added the following line to the first picture of TheContent.SWF:
    System.security.allowDomain ("' http://www.example_shell_host.com ' ");

    However, when I opened "TheShell.SWF" on another area if fails to pull in the SWF file.

    I tried specifying the exact path ("' http://www.example_shell_host.com/creative ' "), but this does not work either. Nor is the use of the "*" credits.

    What I am doing wrong? Do I need to add any code to 'TheShell.SWF '?

    See you soon

    Just a quick update.

    After exhausting all other options, I moved the files of two new servers and they worked very well.

    Thank you

  • Cross domain investment

    I seem to have a complete crossdomain.xml which should work fine. However, I am in a situation that we hope, can be fixed. Here at the U we share the www2.med.umich.edu with other departments. Our service is to launch an adjustment to put the crossdomain in the web root.

    However, it is supposed to be a web root defined for one of our domains 'prmc. I added the crossdomain in this directory, since this is where rss (xml) files. It always seems to try to shoot the crossdomain www2.med.umich.edu and not www2.med.umich.edu/prmc.

    Is there anywhere to specify the path to the cross domain?

    Figured it out.

    In case anyone else has this problem:

    Need to import some flash.system.Security;

    Then you add in init:
    Security.loadPolicyFile (" http://www.yourwebsite.com/anotherfolder/crossdomain.xml");

  • Problem in flex with cross-domain to script using GET method

    Hello

    I have a strange problem in Flex, the appeal of scripts located on other servers, using the GET method.

    When I want to connect with a HTTPService in Flex for a script that is located on a different domain than the flex application, I place a crossdomain.xml in the root of the server script:

    <? XML version = "1.0"? >
    <!- http://www.script-domain.com/crossdomain.xml ->
    < cross-domain-policy >
    < allow-access-from domain = "www.app-domain.com" / >
    < / cross-domain-policy >

    The problem is that when you use the GET method to the crossroads, it seemes that the flashplayer adds search for the crossdomain.xml at the end of the query string. With a url snooper I can that the requested url, and when the player seeks the crossdomain.xml, it does so in a strange way:

    http://www.script-domain.com?var1=val1 & var2 = val2/crossdomain. XML

    It seems to use the url + querystring as a url and puts the crossdomain.xml at the end of the query string, which is NOT the location of it, and the application fails with a runtime error message.

    Looking for the crossdomain.xml should look like this:

    http://www.script-domain.com/crossdomain.XML

    If I use the POST method instead, it works fine, but I would like to be able to use the GET method.

    Any suggestions?

    / Jesper

    Problem solved!

    For correct work crossdomain checking, you must ask the script remote itself and not only the remote folder:

    http://www.remote-domain.com/script.php?va1r=val1&var2=val2

    That's all!

  • Integrating Wordpress in need of Muse dynamic height with cross domain content-based

    Given that Muse does currently not support articles and Wordpress integration I decided to use an iFrame.

    My goal is to have the height of the iframe dynamic change based on the content of my Wordpress blog. I understand that this is a common problem with frames that are hosted on different domains.

    I'm running by having more to compensate with a bunch of deadspace to leave enough room. You can also get the horrible scrolling to the search bar.

    I tried using cross-site scripting, JQuery, and postMessage but can't find out how to put the right code in Muse and Wordpress for them to communicate in either sense.

    Please, any help on this would be greatly appreciated.

    Apparently, you try to insert the iframe to another area and because of the "Same origin" security policy, you are not authorized to access the document property of the iframe object. This will not happen if the inserted iframe is on the same domain.

    Check it for more on this, http://javascript.info/tutorial/same-origin-security-policy

    - Abhishek Maurya

  • More recent emulator ripple to not cross-domain proxy

    My apologies if this question has already been answered, but I just took the time to install the last ripple emulator after much frustration with earlier versions... and now, after following these instructions to the 't', I still can't use the emulator again because it will not allow the domain ajax calls...

    Can someone enlighten me please what I need to do to make this work.  I can provide any other information is needed to help solve this problem.

    Thank you

    OK, so maybe my modified shortcut icon not been fired currently, so I manually chrome.exe launched from the command line with the following parameters:

    -enable-extensions-disable-web-security

    and it works.

    Thank you.

  • Cross domain of the shared Service Trust

    Our Organization is undergoing a merger.  Announcements of 2 circles is "RELIABLE". I activated the followReferral in the Advanced section of the LDAP setting in shared service.

    We need to do to let the users from the new domain showup in shared service.

    Our environment 11.1.2.2.500

    Hey,.
    Another approach would be to add a new directory of the user on shared services, with the new domain.
    Administration-> directories user Configure-> configuration-> New provider
    You could name differently on behalf of existing directory and set the search order 3.

    All users of the new domain must be available as usual under the new name of the directory.

    Best,

    Abhishek

  • Cross domain authentication does not?

    Hello community,

    I ran into a problem with authentication and am confused if it's something that in our configuration, or if it is seen elsewhere as well?

    Scenario:
    1. a service account for installation used, who has access to read for the 3 areas in question. The account itself is one of the 3 areas (not sure if this is the origin of the question, but somehow in doubt).

    2. a single tenant with 3 mounting identity, one for each region stores, all configured exactly the same way;

    Question:

    Users not in the same domain as the systems (which is also the same domain as the service account), cannot connect. There is no error thrown to the logon screen, after a moment of the authentication attempt, the user is with the login screen allowed out again. If I add accounts, which are not members of a handful of groups, they can identify.

    According to the guidelines of VMware, the problem with no authentication is possible that if a user is a member of about 100 nested groups should be solved with update 1, we have applied as well.

    Device name: VMware vCAC device
    Version of the device: 6.0.1.0 build 1569764

    Device name: identity of VMware Appliance
    The unit version: 2.0.1.0 build 1545089

    Thanks for any advice you may have.

    Bij

    Solved this problem by changing the configuration to use only the tenant default and thereby using Native AD authentication. I hope that it might help others who see similar problems.

  • ESXi 5.1 AD join domain issues

    People,


    I need some clarification regarding ESXi 5.1 AD following domain join:

    Location of the object Active Directory computer ESXi

    Where expected or can we place the computer object of ESXi? can move in another custom ORGANIZATIONAL unit can I created myself? as: domain.com/DC1/Production/ESXi servers

    Location of the object group security Active Directory ESXi

    What about the group Admins of ESX? should I put / create in my universal security group of both custom location? as: domain.com/Users/It Admin/Dept/ESX Admins

    Authorization to VCenter

    Do I need to do anything on the tab authorization VCenter to replace the role of Administrator security group assignment existing? because at this time I created the custom security group as a Director for the vShere environment as well as the authorization of some blue folder to select a few people.


    Thanks in advance.

    On the first two questions, it's more an AD organization than anything else. IMHO, Hung specific UO is better that mix everything in one place, so your examples are good.

    The subject of the third, ESXi permissions have no relationship with vCenter permissions - they apply for direct access of ESXi, not reflecting not at all in the way vCenter accesses resources of ESXi.

Maybe you are looking for