Welcome to WebmasterWorld Guest from

Forum Moderators: open

Message Too Old, No Replies

Cross-Site Scripting to Embedding Page



8:01 pm on Mar 23, 2010 (gmt 0)

10+ Year Member

Here is my situation:

I have a Flash file hosted at:


I have a web page that embeds that Flash file at:


The <embed> code for that SWF has the "allowScriptAccess" parameter set to "sameDomain". Currently, I cannot put links in "flash.swf" that change the location of the embedding page, because they are on different domains, and making a getURL() or ExternalInterface call won't be permissible.

Changing "allowScriptAccess" to "always" is not an option. Putting both files on the same domain is also not an option.

Policy files don't seem to be the solution (perhaps I'm coding them wrong?) and changing the "document.domain" of the embedding page doesn't seem to work either.

Has anyone else run into this issue and found a solution work for them?


6:49 pm on Apr 6, 2010 (gmt 0)

10+ Year Member


Featured Threads

Hot Threads This Week

Hot Threads This Month