Facebook Policy File error

Question

By now, I'm really sick and tired of facebook's crossdomain.xml , finally got it working for loading pictures from the server. Now I need to load variables from my app using flash. I'm getting this error.

Error: [strict] Ignoring policy file at http://apps.facebook.com/crossdomain.xml due to   incorrect syntax.  See http://www.adobe.com/go/strict_policy_files to fix this problem.
*** Security Sandbox Violation ***
Connection to http://apps.facebook.com/feline-frenzy/endpoints/challengewin/ halted - not     permitted from http://media.varheroes.com/flash/endpointstest.swf
Error loading data
Error: Request for resource at http://apps.facebook.com/feline-   frenzy/endpoints/challengewin/ by requestor from    http://media.varheroes.com/flash/endpointstest.swf is denied due to lack of policy file  permissions.

Any solutions?

Here is my code:

Security.loadPolicyFile("http://api.facebook.com/crossdomain.xml");
Security.allowDomain("*");
Security.allowInsecureDomain("*");  

myData = new LoadVars()
myData.load("http://apps.facebook.com/feline-frenzy/endpoints/challengewin/") 
myData.onLoad = function(succes){ 
if(succes){ 
     trace("DATA SAVED!!!1");
  } else trace ("Error loading data") 
} 

Answer 1

Just guessing here, but I notice the URL in your call to Security.loadPolicyFile("http://api.facebook.com/crossdomain.xml"); is different from the URL in your error (says it failed to read the policy file at apps.facebook.com/crossdomain.xml)

The second URL is also is the root of your myData.load("http://apps.facebook.com/feline-frenzy/endpoints/challengewin/") URL, which is where you'd expect flash to look for a policy file.

Does this help you narrow down the problem?

Answer 2

I am not sure if Facebook allows access to apps.facebook.com directly from Flash. Although crossdomain.xml in the root is the default file name and placement, you can set it up to be whatever you want. For instance, if could be apps.facebook.com/policies/flashpolicy.xml, or whatever else they could dream up. The reason they might do this is to prevent people from doing exactly what you are trying to do.

You could of course, use a proxy for the service you want to use. You would have a script on your server that would make the request to facebook for you. So instead of hitting http://apps.facebook.com/feline-frenzy/endpoints/challengewin/ you would hit http://yourserver.com/facebookProxy and that proxy script would do the http request to facebook and return the data you are looking for.

Here is just one example written in PHP.