Flash Player security considerations

A "local" SWF file is a file that resides on the viewer's computer instead of the Internet. Flash files running locally are subject to the Flash Player security model, wherein by default they are not allowed to communicate with the Internet or network-enabled files on the local file system. This is the challenge present when creating dynamic local Flash content.

The security model explained here exists in Flash Player 8 and higher. Flash Player 7 is more relaxed in its local security settings, but you have to assume that your general audience will be viewing your application using the current player version—which is now Flash Player 9.

Publish settings security options for local playback

You can affect local playback by setting the local security options in the Publish Settings dialog box for each FLA file. You can either allow the SWF to communicate with local files only or allow the SWF to communicate with network files only (see Figure 1). You cannot allow both options during authoring; only the client can allow both local and network access. By default, Flash allows access to the local file system only.

Figure 1. Local playback security settings in the Publish Settings dialog box

The default setting of local files limits only the Flash file to loading known assets from the local file system, with the exception of loading network-enabled SWF files. I have also seen situations where static XML files will not load from a relative path while using the local files-only setting.

Switching to the network-only setting will allow you use ActionScript and XML permissions files to interact with network-enabled SWF files and server requests. This setting limits you by not allowing the SWF to interact with local non-network SWF files and local content.

Tip: In the scenario wherein you need to communicate across domains from a network file, or you need to communicate to a specific domain from a local file without accessing other local files, then look into using the network-only security setting and use the System object in ActionScript or an XML policy file to allow the cross-domain access.

Tip: In the scenario wherein you need to deliver a local application built with a website file structure (external images, XML files, etc.), you have to use the local-files-only setting and then instruct the viewer on how to enable file system and network access. Only the client can allow both settings at the same time.

Allowing network and script access in the HTML settings

If you would like your SWF file to be able to communicate to other HTML pages while running locally from an HTML page, you have to set the allowNetworking parameter to "all." The same HTML page can access locally available web features such as JavaScript and ActiveX objects if the allowScriptAccess parameter is set to true. Try to experiment with these features before looking to more complex solutions. See Restricting networking APIs in the Flash CS3 Professional LiveDocs for more information.

Note: If you're not using an HTML page for local playback, these parameter settings will not apply to you.

Using the Global Settings Manager

The only way for a locally deployed SWF to load content and data from the local drive and from the Internet is for the client to allow the movie as a trusted site. To do this, the client has to connect to the Internet once to allow the Global Settings Manager to add the site (see Figure 2).

Figure 2. Global Settings Manager options allowing any application running on the desktop to communicate to local and network resources

To enable local and network access in a Flash application viewed in Flash Player 8 and higher from a local drive, you have to export for local files only and allow the application as a trusted site on a client-by-client basis.

Tip: Allowing each application individually as a trusted site is a best practice. Allowing the desktop, or a general folder, as a trusted location can work well for prototyping.

Please see Specifying trusted files using the Settings Manager in the Flash CS3 Professional LiveDocs for more information about global security settings.

Using Flash Player configuration files

It's interesting to note that the author of a Flash application (or anyone who has Flash installed) has a special flag set on their computer that determines if they are a Flash author. The author of the application can see the developer-oriented view of the Global Security Settings panel instead of the user-oriented view others will see. For testing purposes, authors can change the flag from "Author" to "User" in the FlashAuthor.cfg configuration file on their computers. This will allow them to experience the settings manager as a user without Flash installed on their machines.

Also interesting to note is that it's possible to create a list of trusted sites manually by creating a FlashPlayerTrust folder on the client's computer, containing any number of configuration files pointing to trusted sites.

For more information on using Flash configuration files, see Creating configuration files for Flash development in the Flash CS3 Professional LiveDocs.

Page 3 of 4

Previous Page

Next Page