====== Flash Player Security ======

===== Cross-domain access =====

Orbit FlashMap contacts the server when requesting images and other things.  If the server is on a different domain (say ''www.website.com'') than the server (say ''www.hosting.com'') cross-domain issues may arrise.

==== Same Domain ====

When the server is on the same domain, access is granted.

==== Different domain ====

When the server is on a different domain, access is uncertain.  Everything depends on the ''crossdomain.xml'' file, hosted in the root of the server's HTTP root.  This file describes which domains are allowed access.  If this file is absent, access is //not// granted.

This system works, because the Adobe Flash Player plugin follows this agreement.  

The ''crossdomain.xml'' specification : [[http://www.adobe.com/devnet/articles/crossdomain_policy_file_spec.html]]

Example (''http://www.hosting.com/crossdomain.xml'') : 

<code xml>
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
  <allow-access-from domain="website.com" secure="false" />
  <allow-access-from domain="*.website.com" secure="false" />
</cross-domain-policy>
</code>