Why am I getting Security Sandbox Violations in the Flash IDE when running the sample applications or my own applications? at SWX: SWF Data Format

Summary: This warning only occurs when testing your applications from the Flash IDE. Cross-domain data exchange will work correctly when you run your applications from a web server. You can ignore this warning.

SWX RPC lets you to make cross-domain data calls (you can turn this off by setting the allowDomain option in the SWX PHP configuration file at php/swx_config.php to false). This means, for example. that you can have a SWF running on your development server or on your shared host somewhere and you can still consume the SWX RPC services (APIs) on the Public SWX Gateway on swxformat.org.

The Flash IDE, however, will display a Security Sandbox Violation when you run SWX applications in the IDE. This is because applications that run in the IDE use the file:// protocol as opposed to http://. Rest assured that your applications will work correctly when tested from a web server using the http:// protocol.

In short, you can safely ignore this warning.

For a longer explanation, read on.

The way SWX RPC enables cross-domain data exchange is by writing an allowDomain statement to the exact URL of the SWF that called it (your application) in the SWX data SWF that it sends back. The SWX ActionScript Library sends this URL in the SWX RPC call for you.

If you are using the native method via loadMovie(), you need to send the value of _url in a parameter called url in your SWX RPC call manually. Alternatively, when using the native method, if you don't send a url parameter, you can specifically allowDomain the loaded SWX data SWF from the main application and it, in turn, it will allowDomain its parent (your application) if it doesn't receive the url. This second method is discouraged, however, as the SWX data SWF should not require access to your application (if only does so to allow your application access to itself by calling allowDomain on _parent) and a fake SWX data SWF from an untrusted SWX RPC gateway could possibly access data and/or alter your main application when using this method.

To summarize, you can ignore this warning and you should either send a url parameter when using the native method via loadMovie() in SWX RPC or, even simpler, use the SWX ActionScript Library when your applications need to access data across domains.

2 Responses to “Why am I getting Security Sandbox Violations in the Flash IDE when running the sample applications or my own applications?”

Feed for this Entry Trackback Address

1 Beebs
January 14, 2008 at 1:26 am

Thanks for this info. I am starting enjoy this simple yet super cool application.
2 wakeup
August 19, 2008 at 11:39 am

thanks for this info i had that problem once that way next time ill know how to avoid it!

SWX: SWF Data Format

Why am I getting Security Sandbox Violations in the Flash IDE when running the sample applications or my own applications?

2 Responses to “Why am I getting Security Sandbox Violations in the Flash IDE when running the sample applications or my own applications?”

Leave a Reply

Search