title: Writing Flash crossdomain.xml for Amazon S3
body: <p>I have two servers. Server A is an internal server that has access from the outside world set up here in my office. It has a Rails server running on it. I have a second server, Server B, that contains all our static content (images, swfs, javascript, css, etc.), it is an Amazon S3 server. I have given all these files public access.</p>
  
  <p>What I am attempting is to put a swf from Server B on a page served by Server A. Then, the other assets that the swf requires in order to display get dynamically loaded from Server B. Unfortunately, however, somewhere along the way it's failing and the files that are requested to be dynamically loaded just never arrive.</p>
  
  <p>Based on errors in my browser console the swf is expecting a crossdomain.xml file to be on Server A. Based on <a href="http://aws.amazon.com/articles/2011" rel="nofollow">this</a>, it also needs one to be on my S3 server. So, that being the case I have created two crossdomain.xml files, one for each server.</p>
  
  <p>This is Server A's crossdomain.xml file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;!DOCTYPE cross-domain-policy SYSTEM
    "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"&gt;
  &lt;cross-domain-policy&gt;
    &lt;allow-access-from domain="s3-bucket-name.s3.amazonaws.com" /&gt;
  &lt;/cross-domain-policy&gt;
  </code></pre>
  
  <p>This is Server B's crossdomain.xml file:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;    
  &lt;!DOCTYPE cross-domain-policy SYSTEM
    "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"&gt;
  &lt;cross-domain-policy&gt;
    &lt;site-control permitted-cross-domain-policies="master-only"/&gt;
    &lt;allow-access-from domain="*.server-a.com"/&gt;
    &lt;allow-http-request-headers-from domain="*.server-a.com" headers="SOAPAction"/&gt;
  &lt;/cross-domain-policy&gt;
  </code></pre>
  
  <p>Additionally, I am explicitly loading Server B's crossdomain.xml file in my swf:</p>
  
  <pre><code>Security.loadPolicyFile("https://s3-bucket-name.s3.amazonaws.com/crossdomain.xml");
  </code></pre>
  
  <p>No matter what I do, however, it just does not work. I'm not sure what else to try. I've tried looking through a number of the solutions here on SO but nothing has helped me resolve my problem yet. Surely someone else has had more experience in this than I have and can give me some guidance, I'm pretty much out of ideas at this point.</p>
  
  <p><strong>Update</strong>
  Updating my question with some more info.</p>
  
  <p>I tried setting both policy files to * and it started working until it hit:</p>
  
  <pre><code>SecurityError: Error #2121: Security sandbox violation: Loader.content: s3.amazonaws.com/bucket_name/swfs/foo.swf cannot access s3.amazonaws.com/bucket_name/data/swfs/bar.swf. This may be worked around by calling Security.allowDomain.
  </code></pre>
  
  <p>Additionally, I ran Charles and it is pulling the crossdomain.xml from both my local server but I don't see it for s3. </p>
  
  <p><strong>Update 2</strong>
  I tried adding this to the loader:</p>
  
  <pre><code>var context:LoaderContext = new LoaderContext();
  context.securityDomain = SecurityDomain.currentDomain;
  context.applicationDomain = ApplicationDomain.currentDomain;
  Loader.load(new URLRequest(_dataFile), context);
  </code></pre>
  
  <p>This resulted in the files actually downloading! Unfortunately now it crashes out with this:</p>
  
  <pre><code>SecurityError: Error #2119: Security sandbox violation: caller s3.amazonaws.com/bucket_name/swfs/MainSwf.swf cannot access LoaderInfo.applicationDomain owned by s3.amazonaws.com/bucket_name/data/swfs/foo/SecondSwf.swf
  </code></pre>
  
  <p>I've tried including/not including the <code>context.applicationDomain = ApplicationDomain.currentDomain;</code> line but that hasn't resolved the issue.</p>
  
  <p>Where the crash is actually occurring is at a later time after the file is loaded where we are getting the applicationDomain: <code>loader_.contentLoaderInfo.applicationDomain.getDefinition( def.a )</code></p>