MACROMEDIA FLASH 8-ACTIONSCRIPT 2.0 LANGUAGE Reference page 1057

In any cross-domain situation, two parties are involved, and it's important to be clear about
which side is which. For the purposes of this discussion, the side performing the cross-
scripting is called the accessing party (usually the accessing SWF), and the other side is called
the party being accessed (usually the SWF being accessed). To continue the example, when
movieA.swf scripts movieB.swf, movieA.swf is the accessing party, and movieB.swf is the party
being accessed.
Cross-domain permissions that are established with are
System.security.allowDomain()
asymmetrical. In the previous example, movieA.swf can script movieB.swf, but movieB.swf
cannot script movieA.swf, because movieA.swf has not called
to give othersite.com permission to script movieA.swf.
System.security.allowDomain()
You can set up symmetrical permissions by having both SWF files call
System.security.allowDomain().
In addition to protecting SWF files from cross-domain scripting originated by other SWF
files, Flash Player protects SWF files from cross-domain scripting originated by HTML files.
HTML-to-SWF scripting can be performed with older Flash browser functions such as
or callbacks established by using . When
SetVariable ExternalInterface.addCallback()
HTML-to-SWF scripting crosses domain boundaries, the SWF file being accessed must call
, just as when the accessing party is a SWF file, or the
System.security.allowDomain()
operation will fail.
Specifying an IP address as a parameter to does not
System.security.allowDomain()
permit access by all parties that originate at the specified IP address. Instead, it permits access
only by parties that were loaded by explicitly specifying that IP address in their URLs, rather
than by a domain name that maps to that IP address.
security (System.security) 1057