the source

Monday, June 16, 2008

Solving the Soap Cross Domain Problem for Flash Player 9,0,124,0

Recently, the Flash Player update (9,0,124,0) crippled one of our clients’ sites by stopping the Flash-based application from making Soap calls to a web server other than the one that served the SWF.

Despite consulting various internet resources, we were unable to find any solution that worked. Wade Arnold’s blog entry came the closest, but unfortunately included a tag that stopped even previous versions of the Flash Player from working.

The following crossdomain.xml file is the working solution that we came up with. In production, you should restrict the ‘domain=’ fields to the domains that serve your SWFs.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE cross-domain-policy SYSTEM
  <allow-access-from domain="*" />
  <allow-http-request-headers-from domain="*" headers="*" />
posted by Jason at 1:05 pm  


  1. Thanks guys! You saved me hours/days.

    Comment by David — 18 June, 2008 @ 5:31 am

  2. I’m having the same problem as you had, unfortunately even this most open of crossdomain policies doesn’t work. The strange thing is that the first call to our Service is allowed: it’s uses GET. Any subsequent calls to the the Service use POST and they fail.

    I still have no resolution.

    Comment by Luke — 23 July, 2008 @ 3:53 am

  3. @Luke:

    I don’t profess to be an expert in these matters, but doesn’t SOAP require the use of POST? How are you making the first call using GET?

    Comment by Jason — 23 July, 2008 @ 9:11 am

  4. Thanks! Solved also my problem.
    I was using WebService to get data from other domains and suddently things stopeed working.
    Added to the crossdomain.xml and now everything works.

    Comment by emile — 25 July, 2008 @ 6:41 pm

  5. I knew there was something screwy with Wade’s tags. This problem never seemed to affect any amfphp as he’d suggested it would, so I just ignored it. It was an intermittent FileReference upload (when it was to a different subdomain) problem that wouldn’t go away that caused me to find this post…

    Comment by Josh Strike — 29 July, 2008 @ 2:53 pm

  6. Thanks!!! Hours and days is exactly right, I wish Adobe’s documentation was clearer

    Comment by Ben Morrow — 4 August, 2008 @ 1:56 am

  7. LUKE: Looks to me like the GET comes from the call to
    _global.gameService = new WebService(“”);
    Presumably, Flash is just loading the service’s WSDL. The actual processing of the WebService Call is a POST.

    Thanks for this, by the way. I did waste 3 hours today messing with all sorts of things. The Headers section in the crossdomain.xml did the trick!


    Comment by Kevin — 5 August, 2008 @ 4:22 am

  8. Of course – I’d forgotten about requesting the WSDL!

    That makes sense.

    Comment by Jason — 5 August, 2008 @ 9:57 am

  9. Thanks for the help guys, much appreciated.

    Comment by Jonas357 — 27 August, 2008 @ 5:47 pm

  10. Well done guys, the request headers inclusion has done the trick. Shame adobe are not so forthcoming with the resolution.

    Comment by Tayfusion — 6 October, 2008 @ 2:19 am

  11. Thanks Thanks Thanks Thanks 🙂

    Comment by pouic — 23 October, 2008 @ 2:40 am

  12. My god, I am so frustrated with this…
    I have everything working inside the flash ide… everything works smoothly…

    I can not get this to work on my localhost, or my webserver… I am using Apache’s latest, with WAMP…

    Why on early would this not work? I have flash 10, but every policy file that I come across has not worked for me!

    Any suggestions?

    my sample page is:

    You can see that to the right of the labels there is no text responses… UGH!

    Comment by Ryan — 4 August, 2009 @ 9:09 am

  13. @Ryan Are you trying to call web services that reside on some other server (not the one that your flash movie is served from)?

    If so, the cross domain file needs to reside on the server that is serving the web services.

    If that server is out of your control, you may need to look at using some sort of proxy or something so that your flash movie is making requests to your own server and then your server is then making requests to the web services.

    Comment by Jason — 4 August, 2009 @ 9:45 am

RSS feed for comments on this post. TrackBack URI

Leave a comment


Powered by WordPress