IE crossdomain filter on flex application

Question

I have an application that uses a flex form to capture user input. When the user has entered the form data (which includes a drawing area) the application creates a jpg image of the form and sends back to the server. Since the data is sensitive, it has to use https. Also, the client requires both jpg and pdf versions of the form to be stored on the server.

The application sends data back in three steps

1 - send the jpg snapshot with ordernumber

2 - send the form data fields as post data so it is not visible in the address bar

3 - send the pdf data

I am sending the jpg data first using urlloader and waiting for the server to respond before performing opperation 2 and 3 to ensure that the server has created the record associated with the new orderNumber.

This code works fine in IE over http. But If I try to use the application over https, IE blocks the page response from store jpg step and the complete event of the urlloader never fires. The application works fine in FireFox over http or https.

Here is the crossdomain.xml (I have replaced the domain with ""):

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"&gt;

<cross-domain-policy>

  <allow-access-from domain="*.<mydomain>.com" to-ports="*" secure="false"/>
  <allow-http-request-headers-from domain="*.<mydomain>.com" headers="*">

</cross-domain-policy> 

Here is the code that is executed when the user presses the submit button:

private function loaderCompleteHandler(event:Event):void {

            sendPDF();
            sendPatientData();
        }


        private function submitOrder(pEvt:MouseEvent):void
        {
            //disable submit form so the order can't be submitted twice
            formIsValid = false;
            waitVisible = true;

            //submit the jpg image first with the order number, userID, provID
            //and order type.  The receiveing asp will create the new order record
            //and save the jpg file.  jpg MUST be sent first.
            orderNum = userID + "." + provID + "." + Date().toString() + "." + orderType;

            var jpgURL:String = "https://orders.mydomain.com/orderSubmit.asp?sub=jpg&userID=" + userID + "&provID=" + provID + "&oNum=" + orderNum + "&oType=" + orderType;

            var jpgSource:BitmapData = new BitmapData (vbxPrint.width, vbxPrint.height);
            jpgSource.draw(vbxPrint);
            var jpgEncoder:JPEGEncoder = new JPEGEncoder(100);
            var jpgStream:ByteArray = jpgEncoder.encode(jpgSource);

            var header:URLRequestHeader = new URLRequestHeader ("content-type", "application/octet-stream");

            //Make sure to use the correct path to jpg_encoder_download.php
            var jpgURLRequest:URLRequest = new URLRequest (jpgURL);     
            jpgURLRequest.requestHeaders.push(header);              
            jpgURLRequest.method = URLRequestMethod.POST;               
            jpgURLRequest.data = jpgStream;

            //navigateToURL(jpgURLRequest, "_blank");

            var  jpgURLLoader:URLLoader = new URLLoader();

            try
            {
                jpgURLLoader.load(jpgURLRequest);
            }
            catch (error:ArgumentError)
            {
                trace("An ArgumentError has occurred.");
            }
            catch (error:SecurityError)
            {
                trace("A SecurityError has occurred.");
            }

            jpgURLLoader.addEventListener(Event.COMPLETE, loaderCompleteHandler);

        }


        private function sendPatientData ():void
        {
            var dataURL:String = "https://orders.mydomain.com/orderSubmit.asp?sub=data&oNum=" + orderNum + "&oType=" + orderType;

            //Make sure to use the correct path to jpg_encoder_download.php
            var dataURLRequest:URLRequest = new URLRequest (dataURL);       
            dataURLRequest.method = URLRequestMethod.POST;
            var dataUrlVariables:URLVariables = new URLVariables(); 

            dataUrlVariables.userID = userID
            dataUrlVariables.provID = provID
            dataUrlVariables.name = txtPatientName.text
            dataUrlVariables.dob = txtDOB.text
            dataUrlVariables.contact = txtPatientContact.text
            dataUrlVariables.sex=txtSex.text
            dataUrlVariables.ind=txtIndications.text

            dataURLRequest.data = dataUrlVariables
            navigateToURL(dataURLRequest, "_self");     

        }

        private function sendPDF():void
        {
            var url:String = "https://orders.mydomain.com/pdfOrderForm.asp"
            var fileName:String = "orderPDF.pdf&sub=pdf&oNum=" + orderNum + "&oType=" + orderType + "&f=2&t=1" + "&mid=" + ModuleID.toString()
            var jpgSource:BitmapData = new BitmapData (vbxPrint.width, vbxPrint.height);
            jpgSource.draw(vbxPrint);
            var jpgEncoder:JPEGEncoder = new JPEGEncoder(100);
            var jpgStream:ByteArray = jpgEncoder.encode(jpgSource);

            myPDF = new PDF( Orientation.LANDSCAPE,Unit.INCHES,Size.LETTER);
            myPDF.addPage(); 
            myPDF.addImageStream(jpgStream,0,0, 0, 0, 1,ResizeMode.FIT_TO_PAGE );
            myPDF.save(Method.REMOTE,url,Download.ATTACHMENT,fileName);

        }

The target asp page is not sending back any data, except the basic site page template.

Can anyone help me figure out how to get around this IE crossdomain issue? I have turned off the XSS filter in IE tools security settings, but that still didn't solve the problem.

THANKS

Answer 1

Do everything over https. Load the swf from an https url. Send the initial form post via https. Send the images via https.