SecurityError: Error #2048: Security sandbox violation for ArcGIS Online map services

[AlisonSengupta]

I am using the Sample Flex Viewer with IE 8 and every once in awhile I will get the following error.
SecurityError: Error #2048: Security sandbox violation: http://mydomain/myflexapp/index.swf cannot load data from http://server.arcgisonline.com/ArcGIS/rest/services/ESRI_StreetMap_World_2D/MapServer?f=json.

This doesn't happen all of the time.  I am not sure why it occurs especially with Esri's map services.  When it does happen I either have to wait awhile and try again or open a firefox brower and the data comes in just fine.  After that I can open an IE browser and it is working again.  Does anyone have any ideas what may be causing this?  It is driving me nuts.

Many thanks,
Alison

[Drew]

Its probably the crossdomain.xml policy file.
I would suggest posting that file and/or take a read on the link below
http://resources.esri.com/help/9.3/arcgisserver/apis/flex/help/index.html#references/using_crossdoma...

Drew

[AlisonSengupta]

Drew,
I know ESRI has a crossdomain file set up for their service and I have a crossdomain file set up for my services.  It is very non-restrictive...pretty much like the one in the example from the link you posted, but I still get that error.  In fact, I got it this morning.  If I open my web app in firefox the data from ESRI's service will stream in just fine.  Then I can open the same web app on the IE browser and I no longer get the sandbox violation.  It is most bizarre and doesn't happen everytime.  I just don't know what else I can check.
Thanks,
Alison

[BjornSvensson]

The first thing would be to find what response you are getting from the server. You could use httpfox, fiddler, charles etc to look at the http response for the crossdomain request. It is possible that there is a general web traffic problem, or an intermittent error on the ESRI server, or maybe something else along the route from the server to your browser.   Do you get an error when going straight to the crossdomain file?  Or only when it's asked for by the application? Is your web connection stable?

[AlisonSengupta]

Bjorn,
Next time I get the error I will turn on fiddler and post the results.  I don't think it is an ESRI server issue.  If it was then I am sure you would hear about it from more people.  I am inclined to agree that it may be a web traffic problem or something along the route.  I will test when going straight to the crossdomain file when I have the issue.  I will post those results as well.  Thank you for the suggestions.
-Alison

[AlisonSengupta]

Bjorn,
I ran fiddler and the crossdomain for server.arcgisonline.com had a max-age=0, must revalidate for the cache-control entry under response headers.  Does this information help in troubleshooting?
Thanks,
Alison

[BjornSvensson]

Hi Alison, there should be some difference between the successful requests and the failing one.  Does fiddler show the all as Result:200 or is there any 500 errors (usually shows in red to indicate failure).

Either the http response code (200/500 etc) or the actual response should show some difference between good and bad times 🙂

Note that different browsers will have slightly different request/response, so for best comparison use the same browser.

[AlisonSengupta]

Bjorn,
For the crossdomain for server.arcgisonline.com, both the unsuccessful and successful responses had a 200 in the result column.  The only difference was that the unsuccessful response was in blue and the successful response was in black text.  Also, the unsuccessful response had a http/1.0 200 and the successful one had a http/1.1 200.  When there is a http/1.1 the rest services come in and when it is the http/1.0 they don't.  What is the difference between http/1.0 and 1.1?
Thanks,
Alison

[AlisonSengupta]

Bjorn,
Is it possible our firewall is playing a role in my security error issue?  When our problem occurs if I just go to google and then back again to the web app, then the arcgis online services come back.  It is almost like I have to go to another website to reset something.  We have been testing and all of my users seem to have this issue.  If it is our firewall, what can I check to prevent this?
Many thanks,
Alison

[Drew]

Could it be a browser cache issue and ultimately an error somewhere in your code that's causing this?

I have seen similar where  you try and execute a method before the map information is loaded and the application crashes, BUT if you come back to your application it seems to have cached a few things to make it work.

I would make a basic app with just a map and see if you get a similar error.

Drew