MACROMEDIA FLASH 8-ACTIONSCRIPT 2.0 LANGUAGE, Reference

Page: 1066 / 1378

1066 ActionScript classes
You can use
loadPolicyFile()
to load any number of policy files. When considering a
request that requires a policy file, Flash Player always waits for the completion of any policy
file downloads before denying a request. As a final fallback, if no policy file specified with
loadPolicyFile()
authorizes a request, Flash Player consults the original default location, /
crossdomain.xml.
Using the
xmlsocket
protocol along with a specific port number, lets you retrieve policy files
directly from an XMLSocket server, as shown in the following example:
System.security.loadPolicyFile("xmlsocket://foo.com:414");
This causes Flash Player to attempt to retrieve a policy file from the specified host and port.
Any port can be used, not only ports 1024 and higher. Upon establishing a connection with
the specified port, Flash Player transmits
<policy-file-request />
, terminated by a
null
byte. An XMLSocket server can be configured to serve both policy files and normal
XMLSocket connections over the same port, in which case the server should wait for
<policy-file-request />
before transmitting a policy file. A server can also be set up to
serve policy files over a separate port from standard connections, in which case it can send a
policy file as soon as a connection is established on the dedicated policy file port. The server
must send a null byte to terminate a policy file, and may thereafter close the connection; if the
server does not close the connection, Flash Player does so upon receiving the terminating
null
byte.
A policy file served by an XMLSocket server has the same syntax as any other policy file,
except that it must also specify the ports to which access is granted. When a policy file comes
from a port lower than 1024, it can grant access to any ports; when a policy file comes from
port 1024 or higher, it can grant access only to other ports 1024 and higher. The allowed
ports are specified in a
"to-ports"
attribute in the
<allow-access-from>
tag. Single port
numbers, port ranges, and wildcards are all allowed. The following example shows an
XMLSocket policy file:
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.foo.com" to-ports="507,516" />
<allow-access-from domain="*.bar.com" to-ports="516-523" />
<allow-access-from domain="www.foo.com" to-ports="507,516-523" />
<allow-access-from domain="www.bar.com" to-ports="*" />
</cross-domain-policy>
A policy file obtained from the old default location--/crossdomain.xml on an HTTP server on
port 80—implicitly authorizes access to all ports 1024 and above. There is no way to retrieve
a policy file to authorize XMLSocket operations from any other location on an HTTP server;
any custom locations for XMLSocket policy files must be on an XMLSocket server.