Adobe Flex 3 Help

Restricting networking APIs

You can control a SWF file's access to network functionality by setting the allowNetworking parameter in the <object> and <embed> tags in the HTML page that contains the SWF content.

Possible values of allowNetworking are:

  • "all" (the default)--All networking APIs are permitted in the SWF.
  • "internal"--The SWF file may not call browser navigation or browser interaction APIs, listed later in this section, but it may call any other networking APIs.
  • "none"--The SWF file may not call browser navigation or browser interaction APIs, listed later in this section, and it cannot use any SWF-to-SWF communication APIs, also listed later.

Calling a prevented API throws a SecurityError exception.

To set the allowNetworking parameter, in the <object> and <embed> tags in the HTML page that contains a reference the SWF file, add the allowNetworking parameter and set its value, as shown in the following example:

<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
 codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,18,0" 
 width="600" height="400" id="test" align="middle">
<param name="allowNetworking" value="none" />
<param name="movie" value="test.swf" />
<param name="bgcolor" value="#333333" />
<embed src="test.swf" allowNetworking="none" bgcolor="#333333" 
    width="600" height="400"
    name="test" align="middle" type="application/x-shockwave-flash" 
    pluginspage="http://www.macromedia.com/go/getflashplayer" />
</object>

An HTML page may also use a script to generate SWF-embedding tags. You need to alter the script so that it inserts the proper allowNetworking settings. HTML pages generated by Flash and Adobe Flex Builder use the AC_FL_RunContent() function to embed references to SWF files, and you need to add the allowNetworking parameter settings to the script, as in the following:

AC_FL_RunContent( ... "allowNetworking", "none", ...)

The following APIs are prevented when allowNetworking is set to "internal":

  • navigateToURL()
  • fscommand()
  • ExternalInterface.call()

An addition to those APIs on the previous list, the following APIs are also prevented when allowNetworking is set to "none":

  • sendToURL()
  • FileReference.download()
  • FileReference.upload()
  • Loader.load()
  • LocalConnection.connect()
  • LocalConnection.send()
  • NetConnection.connect()
  • NetStream.play()
  • Security.loadPolicyFile()
  • SharedObject.getLocal()
  • SharedObject.getRemote()
  • Socket.connect()
  • Sound.load()
  • URLLoader.load()
  • URLStream.load()
  • XMLSocket.connect()

Even if the selected allowNetworking setting permits a SWF file to use a networking API, there may be other restrictions based on security sandbox limitations, as described in this chapter.

When allowNetworking is set to "none", you cannot reference external media in an <img> tag in the htmlText property of a TextField object (a SecurityError exception is thrown).