# Loading data securely

When playing a Flash document in a Web browser, you can load data into the document only from a file that is on a server in the same subdomain. This prevents Flash documents from being able to download information from other people's servers.

To determine the subdomain of a URL consisting of one or two components, use the entire domain:

Domain | Subdomain
--- | ---
http://macromedia | macromedia
http://macromedia.com | macromedia.com

To determine the subdomain of a URL consisting of more than two components, remove the last level:

Domain | Subdomain
--- | ---
http://x.y.macromedia.com | y.macromedia.com
http://www.macromedia.com | macromedia.com

The following chart shows how the Flash Player determines whether to permit an HTTP request:

When you use the XMLSocket object to create a socket connection with a server, you must use a port numbered 1024 or higher. (Ports with lower numbers are commonly used for Telnet, FTP, the World Wide Web, or Finger.)

Flash relies on standard browser and HTTP and HTTPS security features. Essentially, Flash offers the same security that is available with standard HTML. You should follow the same rules that you follow when building secure HTML Web sites. For example, to support secure passwords in Flash, establish your password authentication with a request to a Web server.

To create a password, use a text field to request a password from the user. Submit it to a server in a `loadVariables` action or in an `XML.sendAndLoad` method using an HTTPS URL with the `POST` method. The Web server can then verify whether the password is valid. This way, the password will never be available in the SWF file.