Flash CS3 Documentation

Learning ActionScript 2.0 in Adobe Flash > Understanding Security > Restricting networking APIs

Restricting networking APIs

You can control a SWF file's access to network functionality by setting the allowNetworking parameter in the <object> and <embed> tags in the HTML page that contains the SWF content.

Possible values of allowNetworking are:

• "all" (the default)--All networking APIs are permitted in the SWF.
• "internal"--The SWF file may not call browser navigation or browser interaction APIs, listed below, but it may call any other networking APIs.
• "none"--The SWF file may not call any networking APIs, listed below. Also, it cannot use any SWF-to-SWF communication APIs, also included in the list below.

To set the allowNetworking parameter, in the <object> and <embed> tags in the HTML page that contains the SWF content, add the allowNetworking parameter and set its value, as shown in the following example:

<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
 codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,18,0" 
 width="600"  height="400" id="test" align="middle">
<param name="allowNetworking" value="none" />
<param name="movie" value="test.swf" />
<param name="bgcolor" value="#333333" />
<embed src="test.swf" allowNetworking="none" bgcolor="#333333" width="600" height="400"  
 name="test" align="middle" type="application/x-shockwave-flash"   
 pluginspage="http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash" />
</object>

The following APIs are prevented when allowNetworking is set to "internal":

• getURL
• MovieClip.getURL
• fscommand()
• ExternalInterface.call()

In addition to the previous APIs, the following APIs are prevented when allowNetworking is set to "none":

• XML.load
• XML.send
• XML.sendAndLoad
• LoadVars.load()
• LoadVars.send
• LoadVars.sendAndLoad
• loadVariables
• loadVariablesNum
• MovieClip.loadVariables
• NetConnection.connect
• NetStream.play
• loadMovie
• loadMovieNum
• MovieClip.loadMovie
• MovieClipLoader.loadClip
• Sound.loadSound
• LocalConnection.connect
• LocalConnection.send
• SharedObject.getLocal
• SharedObject.getRemote
• FileReference.upload
• FileReference.download
• System.security.loadPolicyFile
• XMLSocket.connect

Even if the selected allowNetworking setting permits a SWF file to use a networking API, there may be other restrictions based on security sandbox limitations, as described in this chapter.

When allowNetworking is set to "none", an <img> tag in the htmlText property of a TextField does not display network content.When allowNetworking is set to "none", a symbol from an imported shared library added in the Flash authoring tool (not ActionScript) is prevented at run time.

Flash CS3