[F9] crossdomain or what?

[keyone.it]

Given that this works perfectly with Firefox 2.0/WindowsXP..

I have the following architecture loading an xml feed:


TOP DOCUMENT: a Facebook page, with my application in the Canvas featuring an iFrame.

BOTTOM DOCUMENT: a simple XHTML page with the official JS embedder for Flash media.

FLASH: an AS3 movie, that loads data from a PHP script on the same domain.



I have put a crossdomain.xml policy file on my server, allowing access from Facebook. I have set allowScriptAccess to always.
The freaking thing just doesn't work in IE or Safari.

What happens:
the server returns STATUS 200, but nothing is returned to the Flash movie.
It's just like the PHP script didn't output anything at all.

No errors are thrown, no IOError, no other status code. Nothing.

If I open the BOTTOM DOCUMENT directly, in a new page, everything works perfectly in any browser, so I guess this has to do with the document being framed in a document from another domain.

Is there any way to work around it?

All this security crap is just a pain in the neck. It makes me loose thousands of bucks every year in time waisted.

[keyone.it]

I've changed the configuration slightly:

ONLY DOCUMENT: a Facebook page, with my app in the Canvas, which loads the Flash directly.

The problem is EXACTLY the same as before.

The HTTP_STATUS returned is sometimes 0, sometimes 200.
In IE and Safari, if I open the feed directly in another window of the browser, then everything works great. What the hell!!!!

[whather]

I'm having a similar problem with the whole crossdomain.xml security process within Flash 9. I'm trying to load facebook photo URLs from within Flash and I'm getting security errors when trying to do this because I'm modifying the bitmap data of these images. I notice there are in fact crossdomain.xml files on each of the photo servers, for example:

http://photos-b.ak.facebook.com/crossdomain.xml

Do these crossdomain.xml files give ME access to the photos? Do I now have to give Facebook access to my Flash app by creating my own crossdomain.xml like you said in your post?

How did you solve this issue? Thanks!

[nunomira]

hi whather,

Welcome to FlashKit.

No, that cross domain policy file does not give you access to the photos, unless you're calling them from facebook.com or one of its subdomains, i.e., unless your .swf is hosted there.

If your .swf is hosted at yourdomain.com, the xml file would have to have it too.

<cross-domain-policy>
 <allow-access-from domain="facebook.com"/>
 <allow-access-from domain="*.facebook.com"/>
 <allow-access-from domain="*.yourdomain.com"/>
</cross-domain-policy>

Tipically, youd have this xml file:

<cross-domain-policy>
 <allow-access-from domain="*"/>
</cross-domain-policy>

that would allow access from any domain.