MACROMEDIA FLASH 8-LEARNING ACTIONSCRIPT 2.0 IN FLASH - Page 701

About domains, cross-domain security, and SWF files 701
For further information on System.security.allowDomain(), cross-scripting, and cross-
domain scripting, see allowDomain (security.allowDomain method) in the ActionScript
2.0 Language Reference.
For example, suppose main.swf is served from www.macromedia.com. That SWF file then
loads another SWF file (data.swf) from data.macromedia.com into a movie clip instance that’s
created dynamically using
createEmptyMovieClip().
// In macromedia.swf
this.createEmptyMovieClip("target_mc", this.getNextHighestDepth());
target_mc.loadMovie("http://data.macromedia.com/data.swf");
Suppose that data.swf defines a method named getData() on its main Timeline. By default,
main.swf cannot call the
getData() method defined in data.swf after that file has loaded
because the two SWF files do not reside in the same domain. For example, the following
method call in main.swf, after data.swf has loaded, fails:
// In macromedia.swf, after data.swf has loaded:
target_mc.getData(); // This method call will fail
However, data.swf can grant access to SWF files served from www.macromedia.com by using
the
LocalConnection.allowDomain handler and the System.security.allowDomain()
method, depending on the type of access required. The following code, added to data.swf,
allows a SWF file served from www.macromedia.com to access its variables and methods:
// Within data.swf
this._lockroot = true;
System.security.allowDomain("www.macromedia.com");
var my_lc:LocalConnection = new LocalConnection();
my_lc.allowDomain = function(sendingDomain:String):Boolean {
return (sendingDomain == "www.macromedia.com");
};
function getData():Void {
var timestamp:Date = new Date();
output_txt.text += "data.swf:" + timestamp.toString() + "\n\n";
}
output_txt.text = "**INIT**:\n\n";
Now the getData function in the loaded SWF file can be called by the macromedia.swf file.
Notice that
allowDomain permits any SWF file in the allowed domain to script any other
SWF file in the domain permitting the access, unless the SWF file being accessed is hosted on
a site using a secure protocol (HTTPS).
For more information on domain-name matching, see “Cross-domain and subdomain access
between SWF files” on page 696.