When you use httpService in Flex to read XML from a different domain (such as http://xml.weather.yahoo.com/forecastrss), you get a Security error accessing url error. But in the debug folder (bin-debug by default) it reads just fine. This is really annoying — I’m sure plenty of people have been tripped up by this security issue.
Why does it only work in the debug folder? It turns out the bin-debug folder works only because [系统盘]:Documents and Settings[用户名]Application DataMacromediaFlash Player#SecurityFlashPlayerTrustflexbuilder.cfg sets it as trusted automatically. At actual runtime, it’s blocked by security. In other words, what we need to do is solve the security-block problem.
So how do we fix it?
A fellow dev (iknowkungfoo) ran into this too — “Security error accessing url” problem with Flex SWF — and after digging through the official docs, he found the solution:
Because of security, a client application can access remote data only when one of three conditions is met:
- The compiled SWF file is in the same domain as the remote data source
- You use a proxy, and the SWF file is on the same server as the proxy
- You place a cross-domain file on the remote host
This guy couldn’t be bothered to mess around with a cross-domain file, so he’d rather put the SWF file in the same domain as the data source and satisfy condition one.
But usually we hit this security situation precisely because we want to use an API that another site provides to get something done (Yahoo weather, for instance), so we can’t put the SWF file in the same domain as the remote data source to satisfy condition one. But we can create condition one ourselves to get what we want: put a dynamic page on your own site that fetches the weather from Yahoo, then have the SWF read the result of that dynamic page on your own site (my personal recommendation).
There’s another way: use a proxy. I’ve never tried this one — it feels a bit complicated, you have to write a proxy-config.xml. For details see: Flex3.0调用webservice，没有任何反应（csdn） and Flex Cross-Domain XML Access - Flex Proxy Service
And finally, the nuclear option: if you’ve got the clout (serious negotiating skills), get in touch with Yahoo and have them put a cross-domain file on their site — and you’re all set.