Thanks for the post. Forwarded to our Webkit team for their review.
Here's what I've heard back:
Unfortunately, the HTTP Referer cannot be changed from AIR applications (I'm not sure that it can be changed from flex applications also). There might be a possibility with using a non-application sandbox but the user will have to modify his app.
Here are more details on this: Setting up a sandbox bridge interface
I'll take a look.
Shouldn't this be handled by the component itself? I'm sure I'm not the only one getting this problem, as pointed out by this suggestions on Adobe Labs Ideas : http://ideas.adobe.com/ct/ct_a_view_idea.bix?c=9D564F43-979A-4E35-AA21-85A61B6AB8DE&idea_i d=CA6C107B-CE93-4DAF-82EA-503C4DB2B1F8
Edit : I don't get it. How can creating another sandbox help me?
Message was edited by: kboilydev
The AIR runtime uses a sandbox based security model. This basically means that content loaded for example from the root of your AIR application can only load resources from the local sandbox while content loaded from a non-application sandbox (for example http://www.example.com) can load content only from that specific domain. More info on the AIR security model and how sandboxes work in AIR please read the following article - Introduction to the AIR security model.
The referral cannot be changed programatically in an AIR application but using a non-application sandbox that will load resources from the root of your application but which will behave as they were loaded from a custom domain (http://www.example.com) you could obtain the needed HTTP referral. More info on non-application sandboxes can be found at the following location - Cross-scripting content in different security sandboxes.
Let us know if this helped you,
We decided not to even try this solution as it's too time consuming and we're not even sure we'll get the expected results.
Why is the default value app:/foo.swf instead of sending no referer like any other browser? Most of the time, an invalid referer is worse than none at all and will cause invalidations by websites.
I understand what you are trying to tell me with the sandboxes solution, but as you can see, I don't really care about getting the real referer. I just want to set it empty.
1 person found this helpful
I'd like to recommend a couple of things, first please feel free to enter this request over at bugbase.adobe.com. Post back with the URL and let others know so they can add their votes and comments.
Second, go vote for this feature request over at ideas.adobe.com:
This might seem redundant, but better to get this out there more places so any many people as possible can see the request.