MACROMEDIA FLASH 8-ACTIONSCRIPT 2.0 LANGUAGE Reference page 1058

Version-specific differences Flash Player's cross-domain security rules have evolved from
version to version. The following table summarizes the differences.
Latest SWF allowDomain()
version involved needed?
in the cross-
scripting
operation.
5 or earlier No
6 Yes, if
superdomain
s don't match
7 Yes, if
domains don't
match exactly
8 or later
The versions that control the behavior of Flash Player are SWF versions (the published version
of a SWF file), not the version of Flash Player itself. For example, when Flash Player 8 is
playing a SWF file published for version 7, it applies behavior that is consistent with version
7. This practice ensures that player upgrades do not change the behavior of
System.security.allowDomain()
The version column in the previous table shows the latest SWF version involved in a cross-
scripting operation. Flash Player determines its behavior according to either the accessing
SWF file's version or the version of the SWF file that is being accessed, whichever is later.
The following paragraphs provide more detail about Flash Player security changes involving
System.security.allowDomain()
Version 5. No cross-domain scripting restrictions.
1058 ActionScript classes
allowInsecureDom Which SWF must call
ain() needed? allowDomain() or
allowInsecureDomain
()?
No N/A
The SWF file being
accessed, or any
SWF file with the
same superdomain
as the SWF file
being accessed
Yes, if performing The SWF file being
HTTP-to-HTTPS accessed, or any
access (even if SWF file with
domains match exactly the same
exactly) domain as the SWF
file being accessed
SWF being
accessed
in deployed SWF files.
.
What can be
specified in
allowDomain() or
allowInsecureDomain
()?
• Text-based
domain
(mysite.com)
• IP address
(192.168.1.1)
• Text-based
domain
(mysite.com)
• IP address
(192.168.1.1)
• Wildcard (*)