Specifications

35ADOBE FLEX 3
Building and Deploying Adobe Flex 3 Applications
SWF file loading and cross-scripting are always permitted between SWF files that reside in the same sandbox. For
example, any local-with-filesystem SWF file can load and cross-script any other local-with-filesystem SWF file;
any local-with-networking SWF file can load and cross-script any other local-with-networking SWF file; and so
on. The restrictions appear when two SWF files from different sandboxes or two remote SWF files with different
domains attempt to cooperate.
For SWF files in the remote sandbox, if two SWF files were loaded from the same domain, they can cross-script
without any restrictions. If both SWF files were loaded from a network, but from different domains, you must
provide permissions to allow them to cross-script.
To enable cross-scripting between SWF files, use the Security class’s
allowDomain() and
allowInsecureDomain() methods.
You call these methods from the called SWF file and specify the calling SWF file’s domain. For example, if SWF1
in domainA.com calls a method in SWF2 in domainB, SWF2 must call the allowDomain() method and specifi-
cally allow SWF files from domainA.com to cross-script the method, as the following example shows:
import flash.system.Security;
Security.allowDomain("domainA.com");
If the SWF files are in different sandboxes (for example, if one SWF file was loaded from the local file system and
the other from a network) they must adhere to the following set of rules:
• Remote SWF files (those served over HTTP and other non-local protocols) can never load local SWF files.
• Local-with-networking SWF files can never load local-with-filesystem SWF files, or vice versa.
• Local-with-filesystem SWF files can never load remote SWF files.
• Local-trusted SWF files can load SWF files from any sandbox.
To facilitate SWF-to-SWF communication, you can also use the LocalConnection class. For more information,
see “Using the LocalConnection class” on page 46.
ExternalInterface
You use the ExternalInterface API to let your Flex application call scripts in the wrapper and to allow the wrapper
to call functions in your Flex application. The ExternalInterface API consists primarily of the
call() and
addCallback() methods in the flash.net package.
This communication relies on the domain-based security restrictions that the
allowScriptAccess and
allowNetworking properties define. You set the values of the allowScriptAccess and allowNetworking
properties in the SWF file’s wrapper. For more information, see “About the object and embed tags” on page 321.
By default, the Flex application and the HTML page it is calling must be in the same domain for the
call()
method to succeed. For more information, see “Communicating with the Wrapper” on page 1035 in the Adobe
Flex 3 Developer Guide.