apache flex - Actionscript's ExternalInterface.addCallback only working locally, not in production

Question

In my Flex app, I need a Javascript control to call one of my Actionscript methods. Simple enough, according to the Flex/Actionscript documentation, I wrote this in my Actionscript code:

if (ExternalInterface.available)
    ExternalInterface.addCallback("setName", setNameInActiveWindow);

In the Javascript control I wrote:

document.getElementById('FlexAppId').setName(name);

Works great. Exactly as expected, so I went to production. But it doesn't work in production :(. Same exact code... I can't figure it out. The above Javascript code is run, but the callback is not executed in the Actionscript code.

Does this have something to do with domain security? Locally, I'm using local.mydomain.com:8080 where local.mydomain.com resolves to 127.0.0.1 (I need to do this so some widgets work properly). And the Flex app comes from the same local webserver. In production, however, it's just www.mydomain.com (mydomain.com is not the real domain name) and the Flex app comes from flash.mydomain.com (a CDN).

I have a crossdomain.xml file at www.mydomain.com:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
        <site-control permitted-cross-domain-policies="master-only"/>
        <allow-access-from domain="*.mydomain.com"/>
</cross-domain-policy>

UPDATE: I tried changing the local environment so that the Flex app is referenced from flash.mydomain.com, just like in production. It turns out I get the same problem locally too... so it seems this is some kind of domain security issue despite the crossdomain.xml file I have above. Do I need to change something in my crossdomain.xml? Is there something additional I need to get ExternalInterface.addCallback to work?

UPDATE 2: Got it to work! I had to do both Security.allowDomain("*") and Security.allowInsecureDomain("*"). Setting it to flash.mydomain.com did NOT fix the issue, I had to put a wildcard. allowNetworking had no effect. I need allowScriptAccess="always", but I had that from before. Calling Javascript with ExternalInterface.call works easily with just that parameter. But adding a callback with ExternalInterface.addCallback requires the above Security methods with a wildcard.

Answer 1

Communication between your SWF and the DOM is not handled by the crossdomain file. This kind of interaction between Flash content and the navigator is handled by the values of allowScriptAccess and allowNetworking tags in the html wrapping your SWF.

Because your SWF and the HTML are not from the same qualified domain, you have to set the allowScriptAccess value to always. But take care, because that means if you load an untrusted content in your SWF, it will also have access to the DOM page and possibly do malicious things.

For more info, please look at :

http://tv.adobe.com/watch/how-to-develop-secure-flash-platform-apps/scripting-and-allowscriptaccess/ http://kb2.adobe.com/cps/407/kb407748.html http://blogs.adobe.com/stateofsecurity/2007/07/how_to_restrict_swf_content_fr_1.html