topic Re: Crossdomain issue when using a secured service in ArcGIS API for Flex Questions

Crossdomain issue when using a secured service

ChrisMathers — Tue, 04 Feb 2014 20:10:19 GMT

I have a basic crossdomain.xml in my wwwroot folder with my flex apps and everything is just dandy till I try to use an app with a service that requires a password. When I put in the password the service I get "Error #2048". I dont know why everything works with no security but fails with security. If I un-secure that service the app works without error. The chrome developer tools show an error with it tries to get the crossdomain.xml. Chrome can open the xml url. It doesnt matter if you put in the correct password, the error is the same.

Re: Crossdomain issue when using a secured service

ChrisMathers — Fri, 07 Feb 2014 16:57:32 GMT

Turns out its an https issue. If I open the app as http, log in errors out. If I open the app as https, log in works.

Re: Crossdomain issue when using a secured service

BjornSvensson — Fri, 07 Feb 2014 23:43:22 GMT

It sounds like you might be missing a property in the crossdomain.xml file. Make sure secure="false" to allow http apps to access https content.

<allow-access-from domain="*" secure="false"/>

See for example http://services.arcgisonline.com/crossdomain.xml

Re: Crossdomain issue when using a secured service

ChrisMathers — Mon, 10 Feb 2014 11:51:51 GMT

We had Reiman from ESRI Professional Services do the install for our server site and web adapter. This is the crossdomain file he put in place:

[HTML]<?xml version="1.0" ?>
<cross-domain-policy>
<allow-access-from domain="*" secure="false"/>
<site-control permitted-cross-domain-policies="all"/>
<allow-http-request-headers-from domain="*" headers="*" secure="false"/>
</cross-domain-policy>[/HTML]

It seems like it should work but isn't quite. The simplest solution for us I think is to just have IIS forward everyone to https.