2

My Flash/Flex application is having a problem. For a few months it was able to download files from Twilio but now I'm getting the following error:

(I've had to remove hyperlinks, so imagine "ttp" is really "http". :)

SecurityErrorEvent type="securityError" bubbles=false cancelable=false eventPhase=2 text="Error #2048: Security sandbox violation: ttp://localhost/myapp.swf?v=1 cannot load data from ttp://api.twilio.com/."

I enabled policy logging on my flash plugin and get the following messages:

OK: Searching for in policy files to authorize data loading from resource at ttp://api.twilio.com/ by requestor from ttp://localhost/myapp.swf?v=1 Warning: [strict] Policy file requested from ttp://api.twilio.com/crossdomain.xml redirected to ttps://api.twilio.com/crossdomain.xml; will use final URL in determining scope. Warning: Domain api.twilio.com does not specify a meta-policy. Applying default meta-policy 'master-only'. This configuration is deprecated. See ttp://www.adobe.com/go/strict_policy_files to fix this problem. OK: Policy file accepted: ttps://api.twilio.com/crossdomain.xml Error: Request for resource at ttp://api.twilio.com by requestor from ttp://localhost/myapp.swf?v=1 is denied due to lack of policy file permissions.

So it looks to me like the problem is that Twilio doesn't specify a "meta-policy". Is there a way for me to get around this?

desimusxvii
  • 1,094
  • 1
  • 8
  • 10

3 Answers3

2

localhost and twilio.com are not in the same domain so of course you will get a security error. Twilio needs to add this node into the crossdomain:

<site-control permitted-cross-domain-policies="all"/>

Also, make sure your embedding is up to par:

allowscriptaccess = "always"
allownetworking = "all"

If Twilio won't update the crossdomain.xml then you can install a proxy on the server hosting your flex app and grab the data via your proxy.

John Sheehan
  • 77,456
  • 30
  • 160
  • 194
The_asMan
  • 6,364
  • 4
  • 23
  • 34
  • Twilio updated their crossdomain.xml for me but the problem persists. I've taken the proxy route. – desimusxvii Mar 29 '11 at 13:57
  • odd it looks like they took the crossdomain down completely they might be updating it or trying to figure out what the file does. – The_asMan Mar 29 '11 at 18:25
  • I have implemented the changes above, but am still getting a #2048, not using twillo. Just working between my site and Rackspace cloudfiles CDN. Adding the allow scripts and networking was not a problem. site-control confused me a bit - I put this is a crossdomain.xml file and put this in the root of my site, is this accurate? – Thomas Jan 31 '13 at 18:31
1

As of January 2014, Twilio has added the necessary cross-domain permissions mentioned in this question. If problems persist in this vein, please e-mail our support squad at help@twilio.com

Kevin Whinnery
  • 1,209
  • 10
  • 11
0

the response of get crossdomain.xml must contain the HTTP response header "Content-Type:text/xml"

Hujun
  • 1
  • 1