Policy Files

Chính sách tập tin Trong phần này, bạn sẽ tìm hiểu về các hạn chế bảo mật Flash player khi họ áp dụng để tải dữ liệu bên ngoài, và làm thế nào các hạn chế có thể được bỏ qua. Theo mặc định, một SWF có thể tải dữ liệu bên ngoài chỉ từ các miền mà nó cư trú.
Nội dung trích xuất từ tài liệu:
Policy Files < Day Day Up >Policy FilesIn this section, you will learn about the Flash player security restrictions as they apply toloading external data, and how the restrictions can be bypassed.By default, an SWF can load external data only from the domain on which it resides. Inother words, an SWF running within the Web page athttp://www.electrotank.com/addressbook.html could not load the XML file athttp://www.derekfranklin.com/addresses.xml because the running SWF and the file itsattempting to load are not on the same domain. However, the domain derekfranklin.comcan give permission to SWF files that exist on electrotank.com by using a policy file,allowing those SWF files to load and use content from the derekfranklin.com domain.You will learn more about policy files later in this lesson, but before that you shouldunderstand what the Flash player considers to be a different domain.The Flash player uses exact domain matching to determine whether a Flash file andexternal data source are on the same domain. A subdomain of a domain is not consideredthe same domain as its parent. For example, store.electrotank.com is not considered thesame domain as games.electrotank.com, and www.electrotank.com is not the same aselectrotank.com. If the two domain names dont look exactly alike, letter for letter, theyremismatched, and data exchange is not permitted without being granted access via a policyfile.A policy file is an XML-formatted file that sits in the root directory of a domain. Whenan SWF attempts to load data from another domain, the Flash player checks thedestination domain for a policy file. If a policy file exists, the Flash player loads it andchecks whether the origin domain is granted access. If the origin domain is grantedaccess, the Flash player loads the requested data; otherwise, it doesnt.NOTEThe loading of the policy file is transparent to the user. It happens in the backgroundwithout any special ActionScript coding.The following is the format of a policy file:If the XML were saved to a file called crossdomain.xml and uploaded to the rootdirectory of http://www.gamebook.net, Flash files on www.derekfranklin.com,www.electrotank.com, and the IP 63.74.114.215 would be granted access to load datafrom gamebook.net.NOTEA policy file for a domain must always be named crossdomain.xml and must exist in theroot directory of the domain.The crossdomain.xml file would not grant access to an SWF file on store.electrotank.combecause it doesnt exactly match the authorized domain.The crossdomain.xml file supports wildcards. If you wanted your policy file to allow allsubdomains of electrotank.com, you would use an asterisk in the policy file code asfollows: If you wanted to grant access to all domains everywhere, here is how you would set upthe policy file: TIPWhen you run a Flash movie from your own computer, as you have been doing with theexercises in this book, the domain restrictions just discussed do not apply. SWF filesrunning on your computer can load a file from any domain in the world without having tobe granted access from a crossdomain.xml file. < Day Day Up >