Cross Domain XML is FIXED!!!!

[blanius]

Just found out that as of Flash Player 7.0.19.0 and above you can get cross domain XML with a policy file on your own server. This is GREAT....

What you do is create an XML file that lists the domains that it's ok to retrieve from and in you flash movie you can load this in with

System.security.loadPolicyFile("http://foo.com/sub/dir/pf.xml");

More info on Macromedia site
http://livedocs.macromedia.com/flash/8/main/wwhelp/wwhimpl/js/html/wwhelp.htm?href=Part4_ASLR2.html


Example I just finished tonight that takes advantage of this.
http://www.bretlanius.com/flash/NoaaWeather.html

If you get the station ID for your area you can put it in the swf as NOAAweather.swf?station=XXXX and it will show your local weather.

Station Id codes are at http://www.weather.gov/data/current_obs/

[w.brants]

Just found out that as of Flash Player 7.0.19.0 and above you can get cross domain XML with a policy file on your own server.
I know Bret :)
I find it easier to use a crossdomain.xml file that is read automaticly so I don't need the loadPolicyFile function.
This is how my crossdomain.xml file looks...
<?xml version="1.0"?>
<!-- http://www.geboortegrond.nl/crossdomain.xml -->
<cross-domain-policy>
<allow-access-from domain="*.geboortegrond.nl" />
<allow-access-from domain="*.waterlijn.info" />
</cross-domain-policy>

Wilbert

[blanius]

I was under the impression that what you describe only worked for the source server.

[w.brants]

I was under the impression that what you describe only worked for the source server.

That's true but that goes for your policy file also. You are not allowed to decide that you have the right to access information from my site. Only I (the source provider) can give permission to certain domains. If not, the whole concept would be useless.

I have been looking into this when my brother wanted to display the data from a rss blog on his site. I found only one dutch blog provider www.web-log.nl that used such a cross domain file that made it possible to access the rss data without using a php layer.

[blanius]

Ah but you can! PHP will load a page including a RSS feed from ANY domain. The limitation was an arbirary one that Macromedia imposed on flash. I use the System.security.loadPolicyFile("http://foo.com/sub/dir/pf.xml"); method above and am accessing the NOAA XML feed directly in flash no PHP layer (which I was doing while I built it) I was even using a PHP layer to grab the graphic and resend it to my flash, with with the System.security.loadPolicyFile I didn't have to do that anymore. and the policy file is on MY site

[blanius]

I see now that I was mistaken, Apparently NOAA allows any domain in it's crossdomain.xm I was fooled when it worked and I had read an article on the new feature in new flash players that allow the cossdomain file be loacted in any file in any directory on the server. I took out the line that loads mine and it still works. So that wasn't the fix after all.

It's dumb since we can work aroung this with Server side script so why make us jump through a hoop?

[w.brants]

Apparently NOAA allows any domain in it's crossdomain.xml
Yes, this is their one<?xml version="1.0"?>
<!-- http://weather.gov/crossdomain.xml -->
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

Well, it works. That's the most important thing :)

[blanius]

Any idea why this isn't working when used in flash Xml.load
It works fine direct in browser
<?php

$dataURL = $_GET['loc'];
header('Content-Type: text/xml');

readfile($dataURL);

?>

[w.brants]

If it works in the browser, it also should work in flash provided there are no cross domain security restrictions. Is the php file in the same directory as the swf file ?

[blanius]

yeah it's weird.... I added http://localhost/ to the url when trying it locally and it works, but cannot get it to work on server....

[blanius]

http://www.bretlanius.com/flash/crossdomain.html

Shows the url used in my xml.load copy and paste into URL bar and it works.

[blanius]

Interesting the image is using similar code for images across domains, that avatar is loading from flashkit passed through code on my server

<?php

$dataURL = $_GET['loc'];
if ($_GET['type']=="gif"){
$image=ImageCreateFromGif($dataURL);
}
if ($_GET['type']=="jpeg"){
$image=ImageCreateFromJPEG($dataURL);
}
header('Content-Type: image/jpeg');
ImageJPEG($image);

?>

[blanius]

Oh and if anyone wants the code for the NOAAweather it's
http://bretlanius.com/flash/NoaaWeather.fun

[w.brants]

http://www.bretlanius.com/flash/crossdomain.html

Shows the url used in my xml.load copy and paste into URL bar and it works.
No wonder it doesn't work Bret. Your crossdomain.xml file is wrong. Currently only a swf file that would be on the www.weather.gov domain would be allowed to access your file.

[blanius]

:yikes: thats damn funny. I forgot about the crossdomain file.....

[blanius]

I removed the crossdomain.xml file and it still didn't work......

also changed it to
<?xml version="1.0"?>
<!-- http://bretlanius.com/crossdomain.xml -->
<cross-domain-policy>
<allow-access-from domain="*.bretlanius.com" />
</cross-domain-policy>