Discussion: Cross Domain Policy File Support

This one's really a no-brainer. CloudFiles is marketed (among other things) as a fast and scalable delivery mechanism for content. But there doesn't seem to be any provision for a cross-domain policy file that will allow applications running on other domains to access content on the CloudFiles network!

Adobe's security policy for Flash specifically prohibits access to content (any kind) running on another domain without this policy file. Without it, my interest in CloudFiles, which was huge, suddenly shrank to zero.

http://www.adobe.com/devnet/flashplayer/articles/cross_domain_policy.html

This is something that can be addressed very quickly - preferably within my 30 day grace period - PLEASE!

Putting a cross-domain policy file in the bucket and loading it explicitly using the command System.security.loadPolicyFile('url') might be a solution, but it doesn't appear to work. Anyone had any luck with this?

I see that Amazon S3 addressed this issue 3 years ago:

http://developer.amazonwebservices.com/connect/entry.jspa?categoryID=49&externalID=213

=======================

The loadPolicyFile method is not a solution with the new security model in Flash Player 10 ( and possibly later revisions of Flash Player 9 ). If there is no policy file at the root saying alternate policy files are okay then you can't load in a policy file from somewhere up the tree.

This creates an issue with content that needs to share its data with the SWF that is loading it in. Taking bitmap snapshots or using bitmap/pixelBender effects is impossible with items loaded from cloud files.

=======================

Just ran into this same problem. The weird thing is I've had no issues loading .swf files and communicating between them, however I just tried loading an XML file and I got a sandbox violation.

Rackspace, please get this done ASAP.

=======================

Ok, I'm of the opinion we can knock this off our TODO list. Let me know if you think otherwise.

Last week we (silently) released support for serving files off the root path of a CDN URL by changing the format. The new format of a CDN-enabled Container looks like, http://c0010171.cdn.cloudfiles.rackspcecloud.com/. You can now serve your cross-domain files off that URL and the problem should be solved.

Let us know if this is still a problem.