34
FLASH
MEDIA
SERVER
4.5
CONFIGURATION
AND
ADMINISTRATION
Configuring the server
Last updated 11/28/2012
Verify SWF files
Flash Media Server 3.0, Flash Player 9 Update 3, AIR 1
Note:
To perform SWF verification for HTTP streaming, see SWF verification for Protected HTTP Dynamic Streaming .
You can configure the server to verify client SWF files before allowing them to connect to an application. Verifying
SWF files prevents third parties from creating their own applications that attempt to stream your resources.
You can verify SWF files at the following server scopes:
•
Individual applications. Configure the application-specific Application.xml file.
•
All applications in a virtual host. Configure the Application.xml file in the Vhost folder.
•
Administrative applications that have access to all server levels. Configure the Server.xml file and an
Application.xml file.
SWF verification is disabled by default. To verify SWF files, you must set <
SWFVerification enable = "true">
in
the Application.xml configuration file. When verification is enabled, the server verifies that the client SWF file
requesting a connection to the server matches the
verifying SWF file
. The verifying SWF file is a copy of the client SWF
file that you place on the server or in an external content repository.
By default, the server looks in
rootinstall
/applications/
application_name
/SWFs folder for the verifying SWF file. You
can override this default in the
SWFFolder
tag of the Application.xml file, the Server.xml file, or in the File plug-in. If
you installed Apache with Flash Media Server, you can add a path to the folder from which you serve SWF files. For
example, on Windows, adding the path
<SWFFolder>C:\Program Files\Adobe\Flash Media Server
4\webroot</SWFFolder>
prevents you from needing to maintain two copies of each SWF file.
Note:
If you’re deploying an Adobe AIR application, copy the SWF file you compiled into the AIR package to the server
or external content repository.
When the client SWF file connects to the server, the server verifies it. If the SWF file is verified, it is allowed to connect
to the application. If a client SWF file fails verification, the server disconnects the NetConnection object and logs an
event to the access log. The server does not send a NetStream status message to the client.
For client applications that comprise multiple SWF files or SWF files that dynamically load other SWF files, the SWF
file that contains the NetConnection object to connect to the server is the one that the server attempts to verify.
Note:
SWF files connecting to Flash Media Administration Server cannot be verified.
Locating SWF files for verification
The server looks for verifying SWF files in the following locations, in order:
1
The application-specific Application.xml file, if it exists. The Application.xml file defines the location of verifying
SWF files in the
SWFFolder
tag. If
SWFFolder
contains a file path, the server looks for verifying SWF files in that
file path. If
SWFFolder
is empty, the server looks in the default location: /applications/
application_name
/SWFs.
2
The Vhost-level Application.xml file. This Application.xml file defines the location of verifying SWF files for all
applications on the virtual host. The
SWFFolder
tag defines the location. If
SWFFolder
contains a file path, the
server looks for verifying SWF files in that file path. If
SWFFolder
is empty, the server looks in the default location:
/applications/
application_name
/SWFs.
3
The server checks the
SWFFolder
tag in the Server.xml file. This tag specifies a location for global SWF files, which
means SWF files that are common to all applications.