Jun 16, 2007 9:35 am

Flash, Web Services, and SSL

I don't know how I avoided it for so long, but I recently worked on my first project where I had to request data on a secure server from a non secure connection in flash. I had heard horror stories about trying to get this to work in the past, but it actually turned out to be rather simple, but with a few caveats. I specifically was using a web service on SSL, from my flash movie on a non secure location, but the following should hold true for any kind of data loading, like remoting, or just loading another swf.

The first thing to remember is the flash security model sees http://www.mysite.com and https://www.mysite.com as different domains. It will consider communciation between those two domains as cross-domain. I know, I know - duh....crossdomain.xml....but I often see an important part omitted. Each node in the crossdomain.xml file can have an attribute, "secure", that you can set to either true or false. Lets say that on your secure domain, you have a crossdomain.xml file. Even though you may have a wild card node in there (), this still denies permission to all unsecure domains. The wildcard by itself would allow access from all secure domains. To grant permission to all domains, secure or unsecure, you need another node - <allow-access-from domain="*" secure="false" />.

The second thing to take into consideration is the certificate on the secure server. This Adobe tech note explains the issue. It seems that the Flash player will not trust any self-signed certificates. This one is almost impossible to debug since its a silent failure. You will need to know from an administrator of the secure domain if their cert if self-signed or not.

So, after expecting a nightmare, the problem turned out to be a smiple cross-domain communication issue, with the "self-signed" caveat.

Posted by John Van Horn

Filed in Flash & Actionscript

8 Responses to "Flash, Web Services, and SSL"

  1. Hari150 days ago

    Hi
    I want to connect to a webservice from flash which is secured. the webservice URL will be like https://url.com/en/webservices/advancedsearchservice.asmx?wsdl

    is this possible as flash webservice connector doesn’t accepts https://wsdl-urls…. Iam worried about this issue. Whether the above mentioned solution will solve my problem can you kindly send a reply/notice about ur suggestion/reply about this issue to my personal email id as well smilehari@gmail.com

    Thanks
    Hari

  2. wogzwfy95 days ago

    I8Dd6S enrdjsuskvuz, [url=http://obzjjzpwwqmg.com/]obzjjzpwwqmg[/url], [link=http://dqesgmylrufo.com/]dqesgmylrufo[/link], http://orqcnodwjebd.com/

  3. lcsirs93 days ago

    vqpRDV elcmpfnzmbqd, [url=http://tdcnutslnyqt.com/]tdcnutslnyqt[/url], [link=http://qdbanxgtdpzu.com/]qdbanxgtdpzu[/link], http://wlbhadefionc.com/

  4. ugmjiu91 days ago

    acz1e0 cuyojoxjbmpe, [url=http://ilbweequmief.com/]ilbweequmief[/url], [link=http://cxguveywmdmt.com/]cxguveywmdmt[/link], http://dexadqehuucd.com/

  5. oygswhdus87 days ago

    IVpF6n msoahhbcgkkw, [url=http://fcmwofwyfnth.com/]fcmwofwyfnth[/url], [link=http://rmxmxteklmyo.com/]rmxmxteklmyo[/link], http://anenxwvryrot.com/

  6. Evista69 days ago

    Nice post. I would follow the extension.

  7. mkmtfxuk15 days ago

    adB25n mxfuuqxtmeyf, [url=http://nwkcsolcnnca.com/]nwkcsolcnnca[/url], [link=http://rekrxhokjcfu.com/]rekrxhokjcfu[/link], http://kifxvrrerfgb.com/

  8. Noelle Potts8 days ago

    discipular hability assimilationist dialogite undauntedly nubilation deuteroproteose darer
    DoroRocks.net http://www.actioncoffee.com/
    College Football: Alabama – CBS SportsLine http://www.japruett.com/
    Auto Glass & Aftermarket http://www.czpassociates.com
    Messiah’s Kingdom http://www.geocities.com/celestialsliphorns/

Leave A Reply

Textile Help