0

i have a crossdomain.xml on my server. but it not in "/". and i use loadPolicyFile to load this crossdomain.xml.

Security.allowDomain("*")
Security.allowInsecureDomain("*");
Security.loadPolicyFile(AddressContext.getCurrentEnv().split("rest")[0]+"crossdomain.xml")

the PolicyFile's url is like this : http://siteA.com/aop/crossdomain.xml.

and my restful webservices address is like this : http://siteA.com/aop/rest/start

crossdomain.xml include my flash's host url.

the weird thing is flash still tried to load the http://siteA.com/crossdomain.xml like this

werid img

first is right and response 200. the second response 400 .

finally, the flash still told me SecrityError#2048

i don't know why?

Saito
  • 168
  • 6
  • From what I know the flash always tries to load the crossdomain.xml from the domain root/. can\t you put it in there to fix the issue ? – Adrian Pirvulescu Feb 09 '12 at 13:10

1 Answers1

0
Security.allowDomain("*")
Security.allowInsecureDomain("*");

This is useless and it makes your SWF vulnerable.

Can you post the content of your crossdomain. What value did you set for the meta-policy tag?

Florian F
  • 8,822
  • 4
  • 37
  • 50