14 Replies Latest reply on Dec 22, 2010 12:45 PM by rtalton

    Security error accessing url

    Michael Orzechowski Level 1

      Hello experts

       

      I came across very common and it would seem fairly easy to solve issue.

      I have developed straight forward application (cinema guide) which reads 2 RSS feeds (one from cinemas chain and one from movie critics' website). It allows users to check which movies are shown at particular cinema (also at what dates/times) and in addition it retrieves critics' review (I personally hate to waste time on some really bad movies).

      This application has been developed for my own use but I have decided to upload it to public server so I can access it from anywhere.

      At first attempt of running application on the server (it works perfectly fine on my laptop) I got following error:

       

      Security error accessing url
      Destination: DefaultHTTP

       

      I thought, fair enough, will need to add more entries to my crossdomain.xml file (had one already created).

       

      So crossdomain.xml file at the moment looks like that:

       

      <?xml version="1.0"?>
      <cross-domain-policy>
      <site-control permitted-cross-domain-policies="all"/>
      <allow-access-from domain="http://www.morzech.myzen.co.uk" to-ports="*"/>
      <allow-http-request-headers-from domain="http://www.morzech.myzen.co.uk" headers="*"/>
      <allow-http-request-headers-from domain="http://www.cineworld.co.uk" headers="*"/>
      <allow-http-request-headers-from domain="http://www.rottentomatoes.com" headers="*"/>
      </cross-domain-policy>

       

      You can find my application under following URL:

       

      http://www.morzech.myzen.co.uk/development/CinemaGuide/CinemaGuideSE.html

       

      2 RSS feeds I am importing are:

       

      http://www.cineworld.co.uk/syndication/all-performances.xml

      http://www.rottentomatoes.com/syndication/rss/in_theaters.xml

       

      Please share your ideas on what I might be doing wrong (or what's missing).

       

      Regards

      Michael

        • 1. Re: Security error accessing url
          rtalton Level 4

          Usually these kinds of errors are related to security issues with Flash, but in this case, there are no issues with that. I tested that the two xml feeds are working fine. You do not need a cross-domain policy file; that is only necessary if the server you are requesting data from requires it, and both servers probably already have them in place.

           

          You do not put the cross-domain file on your server unless you are authorizing Flex/Flash applications to access data from your server, and you are not in this case. So get rid of that cross-domain file!

           

          Here is my test app. Put a break point in the ResultEvents and you will see beautifully well-formed xml being returned from the two URLs. You're almost there, so don't give up!

           

          <?xml version="1.0" encoding="utf-8"?>

          <mx:Application

           

          xmlns:mx="http://www.adobe.com/2006/mxml"

          creationComplete="initApp();"

          layout="

          absolute">

           

           

          <mx:Script>

          <![CDATA[

           

          import mx.rpc.events.ResultEvent;

           

          import mx.rpc.events.FaultEvent;

           

           

           

          private function initApp():void {

          cineworldService.send();

          rottenTomatoesService.send();

          }

           

           

          public function handle_cineworldResult(event:ResultEvent):void {

           

          trace();

          }

           

           

          public function handle_cineworldFault(event:FaultEvent):void {

           

          trace();

          }

           

           

          public function handle_rottenTomatoesResult(event:ResultEvent):void {

           

          trace();

          }

           

           

          public function handle_rottenTomatoesFault(event:FaultEvent):void {

           

          trace();

          }

           

          ]]>

           

          </mx:Script>

           

           

          <mx:HTTPService

          id="

          cineworldService"

          fault="handle_cineworldFault(event)"

          result="handle_cineworldResult(event)"

          showBusyCursor="

          true"

          url="

          http://www.cineworld.co.uk/syndication/all-performances.xml"/>

           

           

          <mx:HTTPService

          id="

          rottenTomatoesService"

          fault="handle_rottenTomatoesFault(event)"

          result="handle_rottenTomatoesResult(event)"

          showBusyCursor="

          true"

          url="

          http://www.rottentomatoes.com/syndication/rss/in_theaters.xml"/>

           

           

          </mx:Application>

          • 2. Re: Security error accessing url
            rtalton Level 4

            P.S. I hope your cat has made a New Year's resolution to lose weight!

            • 3. Re: Security error accessing url
              Michael Orzechowski Level 1

              Rtalton

               

              Thanks for prompt reply (much appreciated).
              I think that perhaps I was not 100% clear when describing my issue. You are absolutely right to say that both XML feeds are working fine (unless you are unlucky and request them when provider is doing refresh but that’s a different story). My application works perfectly fine when executed from my laptop.

              Problem with security settings appears when moving application to public server.

               

              I went through many posts and most of them suggested adding following line to crossdomain.xml file (which I already have in place due to other, PHP based project):

               

              <allow-http-request-headers-from domain="DOMAIN_NAME" headers="*"/>

               

              I understand your point:

               

               

              You do not put the cross-domain file on your server unless you are authorizing Flex/Flash applications to access data from your server, and you are not in this case.

               

              but taking into account all other posts regarding similar issues I am not sure if its valid.

               

              Any other ideas?

               

              PS. As far as my cat is concerned he only made a resolution to cut down on drinking and watching soaps on TV. I think he is comfortable with his body and I really can’t push him too much, you know how unpredictable angry cat can be…

               

              Regards
              Michael

              • 4. Re: Security error accessing url
                rtalton Level 4

                Yes, cats can be as unpredictable as xml feeds, sometimes!

                 

                See if this is what you are after:

                https://www.anaheimjobs.com/testSecurityError2.html

                 

                It takes a while to load the data, so be patient.

                • 5. Re: Security error accessing url
                  Flex harUI Adobe Employee

                  The crossdomain.xml files at www.cineworld.co.uk and www.rottentomatoes.com

                  require updating to permit your server (www.morzech.myzen.co.uk)

                   

                  You should have received the same security error if you were testing over

                  http and not file://  There are fewer security rules for file://

                  • 6. Re: Security error accessing url
                    Michael Orzechowski Level 1

                    Rtalton

                     

                    Thanks for publishing example. It seems to be working fine. I am wondering if I might be getting errors because I am loading 2 separate XMLs?!?

                     

                    Flex harUI

                     

                    Is there anything I can do to make it work? Apart from asking before mentioned providers to extend their files, which most definitely they will not...

                     

                    Regards
                    Michael

                    • 7. Re: Security error accessing url
                      rtalton Level 4

                      The problem is with the cross-domain files at the two websites. Again, you don't need the file on your server, dump it. The two websites are blocking access from your domain, and apart from asking them to include you, there is nothing you can do to force them to allow your Flex app to access their data. After all, it is their data, and they can do what they want with it.

                       

                      Accessing more than one web feed url is not the issue; it is solely the security restrictions in place at those two websites.

                      Maybe they don't like "fat cats"?

                      • 8. Re: Security error accessing url
                        Flex harUI Adobe Employee

                        You can use a proxy server

                        • 9. Re: Security error accessing url
                          rtalton Level 4

                          example updated; pulls in both feeds now...

                           

                          https://www.anaheimjobs.com/testSecurityError2.html

                          • 10. Re: Security error accessing url
                            Michael Orzechowski Level 1

                            Rtalton/Flex harUI

                             

                            Thanks for all your efforts. Sadly it all boils down to domain I am using (actually I am not using any). I am going to listen to Flex harUI advice and use proxy server. I already started working on that but did not get far:( I have to abort for now and will resume working on that in 24-36 hours (have a little trip planned). If my attempt to make proxy server (PHP script) will fail I am going to chose easy way and purchase some dummy domain;)

                             

                            Thank you all for your input, will keep you posted.

                             

                            Regards

                            Michael

                            • 11. Re: Security error accessing url
                              rtalton Level 4

                              Just so you know, my solution is a php script which I use as the "proxy server". It can be used on any domain you deploy your Flex file to. Of course, the server has to support php.

                              1 person found this helpful
                              • 12. Re: Security error accessing url
                                Flex harUI Adobe Employee

                                It doesn't matter what your domain is.  I doubt those source servers will

                                allow direct access from Flash/Flex, so don't spend your money on a new

                                domain name for this purpose.

                                 

                                When testing an app from FlashBuilder/FlexBuilder, the url used typically

                                starts with file://.  This bypasses most of the security checks on web

                                server requests.  This is done to make server app development more

                                convenient.  Most folks are developing apps that will contact a server on

                                the same domain as the SWF.  When testing from file:// there is no server

                                portion to the URL so there would be no way to test a domain against the

                                crossdomain.xml anyway so it is allowed.  But when you run from http://,

                                even from http://localhost/ you now have a domain to do security checks

                                against.  You should be getting the same security error if you set up a web

                                server on your computer and set up your project to debug via an http:// url

                                instead of file://

                                1 person found this helpful
                                • 13. Re: Security error accessing url
                                  Michael Orzechowski Level 1

                                  Gents

                                   

                                  I had a chance to work on my little app today and solved security error (had to update quite a bit of code in the process but at least I feel a bit wiser). You can see working example at:

                                   

                                  http://www.morzech.myzen.co.uk/development/CinemaGuide/CinemaGuideSEWP.html

                                   

                                  I have used following PHP script to work as Proxy Server. See example here:

                                   

                                  http://www.switchonthecode.com/tutorials/using-a-php-proxy-with-flex-to-talk-cross-domain

                                   

                                  Unfortunately Rotten Tomatoes does not publish all the ratings in their RSS feeds for some reason.

                                   

                                  You might get error when accessing this app (CineWorld does refresh of XML file several times a day).

                                   

                                  Rtalton, thanks for all your input. Flex harUI thanks a lot for pointing me in the right direction and preventing me from forking out for domain I would not need.

                                   

                                  Regards

                                  Michael

                                  • 14. Re: Security error accessing url
                                    rtalton Level 4

                                    Good job! Thanks for the link to the tute.

                                     

                                    As an alternative, here is the PHP script i was using to get the results from Cineworld's feed into Flex, in case anyone can use it. You can just as easily pass in the url, but I was in a hurry...

                                     

                                    <?php
                                    $filename = 'http://www.cineworld.co.uk/syndication/all-performances.xml';
                                    $handle = fopen($filename, 'r');
                                    $contents = stream_get_contents($handle);
                                    fclose($handle);
                                    echo $contents;
                                    ?>