Accessing cross-domain services with LiveCycle Data Services or BlazeDS
Problem
Flash player has cross-domain security policy that restricts Flex applications from retrieving data from remote third party servers. Unfortunately, certain sites have restrictive polices, or no cross-domain policy at all, making it impossible for Flex clients hosted on other domains to access their service.
Solution
LiveCycle Data Services ES, or its open source variant, BlazeDS, offer proxy service that could help Flex clients bypass the cross-domain restriction.
Detailed explanation
Flash Player Cross Domain Policy
Flash player has cross-domain security policy that restricts Flex applications from retrieving data from remote third party servers. At runtime, when a network request is made from your Flex application, may it be HTTP or SOAP, the Flash player examines the cross domain policy file on the remote server before the data could be retrieved.
The policy file is an XML file named crossdomain.xml, residing at the root of the remote server. The syntax is,
<cross-domain-policy>
<allow-access-from domain="Domain name or IP of the client" />
</cross-domain-policy>
The Yahoo Search API server, for example, allows direct access from third party clients (http://search.yahooapis.com/crossdomain.xml). Notice how the allow-access-from node is set to the wildcard *. Unfortunately, certain sites have more restrictive polices, or no cross domain policy at all. In that case, you need to set up your own proxy server with either LiveCycle Data Services ES or BlazeDS.
Default Proxy Service
After installing LiveCycle Data Services ES or BlazeDS, navigate to the application directory.
The data service proxy configration file, proxy-config.xml, resides under the WEB-INF/flex directory. In your configuration file, there should be one default destination node,
The default proxy destination will forward HTTP payload with an URL specified by your Flex client. Before you could use the proxy service, you must specify the permitted proxy destinations using the dynamic-url property,
<properties>
<dynamic-url>http://cnn.com/*</dynamic-url>
<dynamic-url>http://news.yahoo.com/*</dynamic-url>
</properties>
</destination>
To access the proxy service from your Flex application, ensure your application is properly wired to the data service, and set the useProxy attribute to true,
<mx:WebService url=”http://cnn.com/api?wsdl” useProxy=”true” />
Named Proxy Service
The named proxy service is just like a default proxy service, but with the addition of a URL property,
<properties>
<url>http://rss.cnn.com/rss/cnn_topstories.rss</url>
</properties>
</destination>
To access a named proxy service from MXML,
As you can see, the named proxy simply delegates the URL details from MXML code into the server config file. This is recommended in a production environment. It helps you manage URL changes without recompiling the Flex application.
It’s still possible to use dynamic URLs in a named proxy service. In this case, the URL property serves as the default address for the destination,
<properties>
<url>http://rss.cnn.com/rss/cnn_topstories.rss</url>
<dynamic-url>http://rss.cnn.com/rss/*</dynamic-url>
</properties>
</destination>
Authenticate with External Proxies
If you server resides in a corporate network that must go through a proxy for out-bound traffic, add external-proxy setting to your service properties,
class="flex.messaging.services.HTTPProxyService">
<properties>
<external-proxy>
<server>10.10.10.10</server>
<port>3128</port>
<nt-domain>mycompany</nt-domain>
<username>flex</username>
<password>flex</password>
</external-proxy>
</properties>
…
</service>
