User Guide

Shared objects 483
Shared objects
Flash Player provides the ability to use shared objects, which are ActionScript objects that
persist outside of a SWF file, either locally on a user’s file system or remotely on an RTMP
server. Shared objects, like other media in Flash Player, are partitioned into security
sandboxes. However, the sandbox model for shared objects is somewhat different, because
shared objects are not resources that can ever be accessed across domain boundaries. Instead,
shared objects are always retrieved from a shared object store that is particular to the domain
of each SWF file that calls methods of the SharedObject class. Usually a shared object store is
even more particular than a SWF file’s domain: by default, each SWF file uses a shared object
store particular to its entire origin URL.
A SWF file can use the
localPath parameter of the SharedObject.getLocal() and
SharedObject.getRemote() methods to use a shared object store associated with only a part
of its URL. In this way, the SWF file can permit sharing with other SWF files from other
URLs. Even if you pass
'/' as the localPath parameter, this still specifies a shared object
store particular to its own domain.
Users can restrict shared object access by using the Flash Player Settings dialog box or the
Settings Manager. By default, shared objects can be created up to a maximum of 100 KB of
data per domain. Administrative users and users can also place restrictions on the ability to
write to the file system. For more information, see “Administrative user controls” on page 452
and “User controls” on page 454.
You can specify that a shared object is secure, by specifying
true for the secure parameter of
the
SharedObject.getLocal() method or the SharedObject.getRemote() method. Note
the following about the
secure parameter:
■ If this parameter is set to true, Flash Player creates a new secure shared object or gets a
reference to an existing secure shared object. This secure shared object can be read from or
written to only by SWF files delivered over HTTPS that call
SharedObject.getLocal()
with the
secure parameter set to true.
■ If this parameter is set to false, Flash Player creates a new shared object or gets a
reference to an existing shared object that can be read from or written to by SWF files
delivered over non-HTTPS connections.
If the calling SWF file is not from an HTTPS URL, specifying
true for the secure
parameter of the
SharedObject.getLocal() method or the SharedObject.getRemote()
method results in a SecurityError exception.