Flash CS3 Documentation

Programming ActionScript 3.0 > Flash Player security > Restricting networking APIs

Restricting networking APIs

You can control a SWF file's access to network functionality by setting the allowNetworking parameter in the <object> and <embed> tags in the HTML page that contains the SWF content.

Possible values of allowNetworking are:

• "all" (the default)--All networking APIs are permitted in the SWF.
• "internal"--The SWF file may not call browser navigation or browser interaction APIs, listed later in this section, but it may call any other networking APIs.
• "none"--The SWF file may not call browser navigation or browser interaction APIs, listed later in this section, and it cannot use any SWF-to-SWF communication APIs, also listed later.

Calling a prevented API throws a SecurityError exception.

To set the allowNetworking parameter, in the <object> and <embed> tags in the HTML page that contains a reference the SWF file, add the allowNetworking parameter and set its value, as shown in the following example:

<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
 codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,18,0" 
 width="600" height="400" id="test" align="middle">
<param name="allowNetworking" value="none" />
<param name="movie" value="test.swf" />
<param name="bgcolor" value="#333333" />
<embed src="test.swf" allowNetworking="none" bgcolor="#333333" 
    width="600" height="400"  
    name="test" align="middle" type="application/x-shockwave-flash"   
    pluginspage="http://www.macromedia.com/go/getflashplayer" />
</object>

An HTML page may also use a script to generate SWF-embedding tags. You need to alter the script so that it inserts the proper allowNetworking settings. HTML pages generated by Flash and Adobe Flex Builder use the AC_FL_RunContent() function to embed references to SWF files, and you need to add the allowNetworking parameter settings to the script, as in the following:

AC_FL_RunContent( ... "allowNetworking", "none", ...)

The following APIs are prevented when allowNetworking is set to "internal":

• navigateToURL()
• fscommand()
• ExternalInterface.call()

An addition to those APIs on the previous list, the following APIs are also prevented when allowNetworking is set to "none":

• sendToURL()
• FileReference.download()
• FileReference.upload()
• Loader.load()
• LocalConnection.connect()
• LocalConnection.send()
• NetConnection.connect()
• NetStream.play()
• Security.loadPolicyFile()
• SharedObject.getLocal()
• SharedObject.getRemote()
• Socket.connect()
• Sound.load()
• URLLoader.load()
• URLStream.load()
• XMLSocket.connect()

Even if the selected allowNetworking setting permits a SWF file to use a networking API, there may be other restrictions based on security sandbox limitations, as described in this chapter.

When allowNetworking is set to "none", you cannot reference external media in an <img> tag in the htmlText property of a TextField object (a SecurityError exception is thrown).

When allowNetworking is set to "none", a symbol from an imported shared library added in the Flash authoring tool (not ActionScript) is blocked at run time.

Flash CS3