I\'m going to be as specific and verbose as possible and include some of the code I\'m using. I already did a search and found this question, which seems similar; however th
I just figured it out! It did have to do with the Security.allowDomain
commands in my Flash file. I was actually hosting the test.html
on a subdomain of domainone.com, and that was throwing it off. It has to be an exact match, subdomain and all. It turns out I didn't need the Security.allowDomain
command that referenced domaintwo.com, nor did I need the crossdomain.xml
file to be present at all for Scenario 3!
Since in the "real" version of this script that I end up using, I won't necessarily know what domainone.com actually is, I changed the code on the top of the Flash file to this:
import ajax.AjaxRequest;
try {
var domain1:String = LoaderInfo(this.root.loaderInfo).parameters["allow"];
if ( domain1.length > 0 ) {
Security.allowDomain(domain1);
}
} catch (error:Error) { }
try {
var domain2:String = LoaderInfo(this.root.loaderInfo).parameters["allowhttps"];
if ( domain2.length > 0 ) {
Security.allowInsecureDomain(domain2);
}
} catch (error:Error) { }
...
Then, in the JavaScript I'm using to embed the SWF there in the first place, I basically grab the current domain of the page from document.location.toString()
, check whether it's using http or https, and then pass the domain in as allow
and/or allowhttps
in the flashvars parameter. There might be a "better" way to do this that doesn't rely on setting the domain up explicitly in the Flash Vars (some kind of automatic detection from within Flash), but I'm not versed in ActionScript well enough to figure that out. And since this file is already doing a whole bunch of bidirectional communication between JavaScript and ActionScript, it's not that big of a deal. This solution is good enough for me.