Security Sandbox Issues with Flex/AS3 and AppEngine

Question

I'm having trouble with an AS3 AMF RemoteObject request that is hosted on App Engine. I have a crossdomain.xml file in the root of the domain, and also one at the remoting endpoint.

Here are the contents of the root crossdomain.xml:

<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies ="all"/>
<allow-access-from domain="*.appspot.com"/>
<allow-access-from domain="*.{appid}.appspot.com"/>
<allow-access-from domain="*.{appid}.com"/>
<allow-access-from domain="*.{appid}.org"/>
</cross-domain-policy>

I have replaced my application's ID with {appid}. In the endpoint crossdomain.xml, it says the exact same thing, except it omits the <site-control> tag.

Loading the swf file and testing it on my machine works just fine... I think that may have something to do with me having the debugger version of Flash Player. When I push it up to App Engine to make it public, other clients access it and get a Client.Error.MessageSend Channel.Security.Error error Error #2048 url: http://05-alpha.latest.{appid}.appspot.com/_rpc/data.

I am using Flex 4 beta, and the App Engine Python runtime. I have tried full wildcard in the crossdomain, and even accessing the data endpoint at a relative URL so as to avoid this error.

Someone please help! Thanks in advance.

Answer 1

This problem deals with Flex Builder and the Flex Builder plugin for Eclipse.

If you have Network Monitoring on when you run your project (an extremely useful feature that lets you monitor data moving over the wire), Builder automatically modifies your SWF to redirect traffic through a server running on your local machine so you can monitor it.

To fix the problem, disable Network Monitoring when you compile your project.

Adobe really should fix this issue... it's easy to forget that monitoring is on since most developers I know leave it on all the time.

More info about Network Monitor: http://anirudhs.chaosnet.org/blog/2009.06.01.html