SecurityError 2048 & URLLoader

[divillysausages]

Hi guys,

I've been running into a problem with the SecurityError that stops a swf loading data from a URL on another server.

What I'm trying to do:
I'm trying to make a request to the StumbleUpon REST API from flash. Basically I'm using URLLoader and requesting like this:

var req:URLRequest = new URLRequest( "http://www.stumbleupon.com/services/1.01/badge.getinfo?url=http://www.myurl.com/");
			
// set the the URL Loader
if ( this.m_loader == null )
{	
	this.m_loader = new URLLoader;
	this.m_loader.addEventListener( Event.COMPLETE, this._onComplete );
	this.m_loader.addEventListener( HTTPStatusEvent.HTTP_STATUS, this._onHTTPStatus );
	this.m_loader.addEventListener( IOErrorEvent.IO_ERROR, this._onIOError );
	this.m_loader.addEventListener( SecurityErrorEvent.SECURITY_ERROR, this._onSecurityError );
}

// get the data
this.m_loader.load( req );

Testing on local, everything works. Once it's on the remote server however, I get the 2048 error:

Error: [SecurityErrorEvent type="securityError" bubbles=false cancelable=false eventPhase=2 text="Error #2048: Security sandbox violation: http://divillysausages.com/flash/Share.swf cannot load data from http://www.stumbleupon.com/services/1.01/badge.getinfo?url=http://divillysausages.com."]

So first things first, I check to see if StumbleUpon has a crossdomain.xml file. They do, and it's this:

<?xml version="1.0"?> 
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> 
<cross-domain-policy> 
	<allow-access-from domain="www.stumbleupon.com" /> 
	<allow-access-from domain="*.stumble.net" /> 
	<allow-access-from domain="stumble.net" /> 
	<allow-access-from domain="*.stumbleupon.com" /> 
	<allow-access-from domain="stumbleupon.com" /> 
	<allow-access-from domain="cdn.stumble-upon.com" /> 
</cross-domain-policy>

Next, I enable proxy logging to see if it's being loaded alright. I get this:

OK: Root-level SWF loaded: http://divillysausages.com/flash/Share.swf
OK: Searching for <allow-access-from> in policy files to authorize data loading from resource at http://www.stumbleupon.com/services/1.01/badge.getinfo?url=http://divillysausages.com by requestor from http://divillysausages.com/flash/Share.swf
Warning: Domain www.stumbleupon.com does not specify a meta-policy.  Applying default meta-policy 'master-only'.  This configuration is deprecated.  See http://www.adobe.com/go/strict_policy_files to fix this problem.
OK: Policy file accepted: http://www.stumbleupon.com/crossdomain.xml
Error: Request for resource at http://www.stumbleupon.com/services/1.01/badge.getinfo?url=http://divillysausages.com by requestor from http://divillysausages.com/flash/Share.swf is denied due to lack of policy file permissions.

OK, fair enough, there was a warning that the meta-policy wasn't specified, but the policy file was accepted all the same. Still no joy however.

After doing *a lot* of reading, I came across this url http://www.thecosmonaut.com/2008/08/...-policy-files/ that says (it deals with flash 9):
"Flash 9 will only accept policy files of the following content-types:

• text/* (any text type)
• application/xml or application/xhtml+xml"

Using Charles, I took a look at the crossdomain.xml file that was being served up, and the Mime-type and Content-type of the xml file weren't set. Perhaps that means nothing; after all, the policy logging said that the file was accepted.

So, at the end, after spending about 4hrs this evening looking at posts, documenation, forum threads etc., I still can't get this data to load. It *will* load when I test the SWF locally, and I also tested the Facebook Graph API using this code (both locally and on the server) and that worked, which makes me think the problem is in the crossdomain.xml file of StumbleUpon.

Has anyone else come across this? Have you any ideas? Something else I could try (aside from creating a proxy through my server - the idea is that the code should work from anywhere)?

Thanks

[moagrius]

i don't think it's the mime type of the XML - it looks like their crossdomain policy doesn't allow off-site access (all the allowed domains are theirs). i think the "OK" line is just saying that the policy file was read, but the line beneath it seems to confirm that only those domains listed are allowed access.

i think you're stuck with a proxy file, but you can crossdomain your own server to let your application work elsewhere. i did a craigslist RSS sniffer and had to do exactly that.

anyways, my 2 cents - maybe someone else has a better suggestion.

[divillysausages]

Thanks for the reply moagrius. I'm not sure if they originally intended to do it like that or not - half the information on cross domain policy files on the internet is a bit insane. Still it's worth an email their way. I don't want to have to proxy request through my site for what was essentially a test
Thanks again