TechNote (Archived)

Macromedia Flash Security Sandbox

In an effort to enhance security, some changes have been made to the Macromedia Flash Player 7 security sandbox. This sandbox provides a restricted area that "surrounds" the player and restricts access to private data. The following is a list of important security related items to be aware of:

• For security reasons, a Flash movie is not permitted to access ActionScript objects and variables in another Flash movie loaded from a different domain. This restriction includes functions, movie clips, text fields, and variables. Attempts to access cross-domain data will be ignored by the Macromedia Flash Player.
  
  • Example 1:http://www.macromedia.com/movie1.swf loadshttp://www.macromedia.com/movie2.swf into _level2.
    
    Since the two movies reside at the exact same domain (www.macromedia.com), they are permitted to access each other's data using ActionScript.
    
  • Example 2:http://www.macromedia.com/movie1.swf loadshttp://www.shockwave.com/movie3.swf into _level3.
    
    Since the two movies reside in different domains, they arenot permitted to access each other's data. When movie1.swf tries to access _level3.someVariable, the request will be rejected and undefined will be returned.
    
• When using subdomains with the ActionScript methods XML.load, XML.sendAndLoad, loadVariables and XMLSocket, domain names and subdomains must match exactly.
  
  Under the new Macromedia Flash Player 7 security restrictions, data can only be loaded from a domain that is an exact match to the location of the SWF, including subdomains. For this reason a SWF residing at server1.mydomain.com will not be able to access data from a SWF at mydomain.com. However, if you are loading data using the ActionScript methods listed above, you can implement a policy file on the target server to make loading of data permissible. For more information on security and policy files, please refer to External data not accessible outside a Flash movie's domain (TechNote 14213).
  
  Note: The methods of loading data listed above are permitted in the security sandbox for Macromedia Flash Player 6.
• Macromedia Flash security sandbox restrictions are applied to Flash 6 and 7 SWF files only. Flash 7 files have a tighter security in that they only allow data exchange between domain that match exactly. Macromedia Flash 4 and 5 SWF files will continue to function as before. For instance, a Flash 5 SWF file is able to access variables in another Flash 5 SWF file loaded from a different domain. Additionally, a Flash 4 or Flash 5 SWF file may not access variables in a Flash 6 or 7 SWF file loaded from a different domain.

Additional information

The security features documented in this TechNote were added to the Macromedia Flash Player at the request of developers. These enhanced security features were added to address potential issues with data transfer to and from Flash movies based upon consultation with industry experts.

For more information on Macromedia Flash Player's Security Sandbox, refer to the Macromedia Flash MX Security white paper (this link will open a PDF file).

To see the ActionScript Dictionary entry for System.security.allowDomain (the mechanism that permits cross-domain access between SWF files), refer to the most recent Macromedia Flash MX Documentation. Download the latest Flash MX documentation from Macromedia Flash MX Documentation Update (TechNote 16470).

For more information on loading data across domains, refer to Loading data across domains (TechNote 16520).

For more information on Load Variables security, refer to External data not accessible outside a Flash movie's domain (TechNote 14213).

Search Support

---