flash and cross domain problem

问题

I'm running a rails3 project with an external asset host for all javascript, images, swfs etc. This is on a completely different domain. So know I tried to embed some SWFs using swfobject. In development (same host) everything works fine, but in production (different hosts) it doesn't start the flash (firebug shows the file is loaded but nothing appears on the page). I already put this crossdomain.xml file in the root of the asset host but it does not change anything at all.

http://my.host/crossdomain.xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
  <allow-access-from domain="*" />
</cross-domain-policy>

http://my.host/swfs/sound1.swf http://my.host/swfs/video1.swf ...

What can I do to make it work? The SWFs I'm using are not developed by me, so I cannot change them. Some are simple sounds, others are videos and small "apps". I don't want to have to make rails serve the swfs.

回答1:

Your "content" host needs to allow access from your "asset" host, not the other way around.

This is to protect users from cross site scripting, so having the host that holds the files decide whether or not they can have access would be all backwards.

回答2:

<allow-access-from domain="*"/> doesn't work in recent Flash versions, you have to specify the exact domain and ports, e.g.:

<cross-domain-policy>
   <site-control permitted-cross-domain-policies="all"/>
   <allow-access-from domain="my.host" to-ports="80,8080"/>
</cross-domain-policy>

And surely you should put the crossdomain.xml into the root of your rails app public directory, not on your asset host.

回答3:

Additional to the above answer (put the crossdomain.xml on the requesting host, not the asset host) I had to add the param allowscriptaccess: "always" to swfobject. Otherwise the ExternalInterface in the flash could not be started.

来源：https://stackoverflow.com/questions/4179878/flash-and-cross-domain-problem