10 Replies Latest reply on Mar 16, 2012 5:01 AM by C.Sathish

    "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml

    JoshBeall Level 1

      Hi All,

       

      I've been working on a small app in Flash Builder.  It's hosted on my Windows 7 box, which is running IIS7.  I'm running some data services on my box, also hosted in IIS.

       

      It's been working just fine when I pull it up locally, but after sending it to a coworker to get some feedback I discovered that from any other machine, the calls to the JSON data services are all failing with an error, "Security error accessing url".  My initial thought was that I had the wrong base URL, and sure enough, I did--my data services were configured to use the base URL http://localhost/.  I changed it to use my machine name, and thought that would fix it.  It did not.  I then decided to add a crossdomain.xml file, but it turns out it's already there from a previous project I did.  It's allowing all traffic (I included it at the end of this post).

       

      So, my data service is on the same domain that the SWF is served from, and that domain also has a crossdomain.xml file in place that should allow access.  But for some reason, it's still failing with a security error.  Any suggestions on where to look next?  What might I have misconfigured?

       

      <?xml version="1.0"?>

      <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">

      <cross-domain-policy>

          <allow-access-from domain="*" />

      </cross-domain-policy>

        • 1. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
          JoshBeall Level 1

          Ok, using Fiddler2 I was able to see that even though I've chagned the base URL in the "Configure HTTP Service" dialog of Flash Builder, it is still attempting to communicate with localhost.  So there must be somewhere else that I need to change localhost to my machine name.

           

          Of course what I really want is to not define a path that includes a domain name at all--I want the service to simply call an absolute path that's on the same domain as whatever domain the SWF was served from... can I do that?  When I got rid of the base URL and then gave an absolute URL path (e.g., /roster/deleteMember), Flex Builder complained that "File does not exist."  Well, of course it doesn't exist, it isn't a file, it's a URL to a service call--there is no corresponding file on the filesystem.

          • 2. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
            JoshBeall Level 1

            I did a text-search of all files in my project, and the only other place the string "localhost" was used is in .flexProperties, in the "serverRoot" property.  I surmised that this was a project I could configure inside Flash Builder's project properties dialog, and sure enough, it was.  I changed it to use the name of my machine in the server root, saved my changes, and now there is nowhere in my project where the string "localhost" appears.

             

            Yet, I can see with Fiddler2 (or just watching the status bar in Firefox) that it's trying to retrieve data from localhost, not from josh-hz6vhl1 (my development machine's name).

             

            Suggestions?  There must be some config setting that I need to change still...

             

            JFYI, here's what the "configure HTTP Service" dialog looks like.

             

            HttpServiceConfig.png

            • 3. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
              JoshBeall Level 1

              I tried completely deleting the service by right clicking on it in the Data/Services tab and choosing deleted, checking everything it gave me the option to delete in that dialog, and then removing the services.rosterservice and valueObjects packages in the Package Explorer.

               

              So, everything was gone.  I confirmed that Group_Services_Roster.fml now back to a plain-vanilla .fml file--no service definition information of any kind, just a few lines to make it well formed XML (open and closing tags).

               

              I then went back and completely recreated my service from scratch using Flash Builder's "wizards" available through the Data/Services tab.  Added the service, configured the return types... then once I got it all working again, I launched it via ctrl-f11.

               

              Result?  Exactly the same.  It's still hitting http://localhost/ for the service calls, even though I used http://josh-hz6vhl1/ everywhere it asked for a domain name!  Nowhere did I mention localhost.  What is going on here!?

               

              Obviously, I can't get my Flex app to work on any other machine if it's always going to hit localhost for the data services!

               

                -Josh

              • 5. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
                Gregory Lafrance Level 6

                You might need to set the --use-network=true compiler option, to false or true depending on your situation.


                Project - Properties - Flex Compiler


                add --use-network=true to the "Additional compiler arguments:" section.

                 

                When deploying to a live server you probably have to recompile with --use-network=true.

                 

                If this post answers your question or helps, please mark it as such.


                Greg Lafrance - Flex 2 and 3 ACE certified

                www.ChikaraDev.com

                Flex Training and Support Services

                • 6. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
                  JoshBeall Level 1

                  Interesting--I'll take a look at that.  But I'm confused as to why adding --use-network=true would help, since the default value of --use-network is true.  The docs on that are here:

                  http://help.adobe.com/en_US/flex/using/WS2db454920e96a9e51e63e3d11c0bf69084-7a92.html

                   

                    -Josh

                  • 7. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
                    JoshBeall Level 1

                    Ok, I'm really baffled now.  --use-network=true didn't help, but what did help was to totally recreate the project with a different name.  So, it's exactly the same project (I even used WinMerge to compare the two project folders), and the new one works just fine, while the old one, despite being exactly the same, tries to communicate with localhost...

                     

                    I'm really baffled!

                    • 8. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
                      JoshBeall Level 1

                      Well now this is great.  As I've continued development on my new project (in which I copy/pasted the MXML and manually recreated the service calls via the Data Services tab), and it's been working great.  I've been sending it to coworkers for review regularly, and it's been working fine for them.

                       

                      Yesterday, I got two independent reports that it was no longer working for my coworkers.  Odd, because it's still working just fine for me... upon closer investigation I discovered that it has reverted to calling localhost for all the service calls, rather than josh-hz6vhl1 (the machine name of my workstation, which is hosting the services).

                       

                      I am dumbfounded.  How could this be?  I have no changed the definition of any of my services, except for adding an additional method--and I never touched the  "Base URL" value in the Configure HTTP Service dialog where my services are defined.  But I can see in the status bar of the browser that it is not attempting to connect to localhost whenever a service call is initiated.  This works fine on my machine, but not on anybody else's machine, of course.

                       

                      The service definition still lists the property Base URL, which is http://josh-hz6vhl1/GroupServicesSite/Roster.aspx/.  I did a search and localhost appears nowhere in my project.  How could it be that it started calling localhost?  I'm not positive but it may have started doing this after I added the new service call...?

                       

                      If I could get this figured out, that might be an alternative solution--then I wouldn't even have to specify a domain name at all...

                       

                        -Josh

                      • 9. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
                        JoshBeall Level 1

                        Well, as is often the case, once I figured out what was going on, it was very simple.

                         

                        When you turn on the Network Monitor tool, it rewrites the URLs of any services you call to instead call localhost, which (it appears) acts as a proxy.  So transparently to you, instead of directly calling any services, your app calls the network monitor on localhost, and the network monitor then calls the services, wherever they reside.

                         

                        Once I turned off the network monitor, my problem went away--the Flex app is now calling things on the proper domain.

                         

                        There should be a FAQ entry on this--the network monitor will only work if you are running your Flex app on the same machine you have Flash Builder installed on.  That means that whenever the network monitor is turned on, you cannot send a link to your app to anyone on another machine--it won't work for them until you've turned the network monitor off.  Unless you're not using any remote services whatsoever in your Flex app--and what fun is that!? ;-)

                         

                          -Josh

                        • 10. Re: "Security error accessing url" even when staying on same domain, *and* I've got a crossdomain.xml
                          C.Sathish Level 1

                          adding the compiler argument -use-network=false worked for me.