Joeflash’s Enigmacopaedia

The RPC Fault Security Error that wasn’t

Posted in Books, Flex, Community MX, Security by Joeflash on the February 1st, 2009

In the first chapter of our upcoming book Professional Flex 3, I built a simple RSS reader in just a few lines of code to demonstrate how easy it is to build a Flex application. I expanded on this application in a few recent articles at Community MX, creating a mini RSS feed reader for all the book authors. All was well, until one of our tech editors Matthew Fabb, told me that the reader I built was producing a dreaded security error. Good catch Matt!

Here’s the original RSS reader code used in the book:

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <mx:Application xmlns:mx="feed://http://www.adobe.com/2006/mxml"
  3.     layout="absolute" creationComplete="RSSFeed.send();">
  4.     <mx:HTTPService id="RSSFeed" url="feed://http//www.joeflash.ca/blog/feed/"/>
  5.     <mx:List id="postTitles" labelField="title" left="20" right="20" top="20"
  6.         dataProvider="{RSSFeed.lastResult.rss.channel.item}"/>
  7.     <mx:TextArea htmlText="{postTitles.selectedItem.description}"
  8.         left="20" right="20" top="190" height="200"/>
  9.     <mx:Button label="Go to page" left="20" top="400"
  10.         click="navigateToURL(new URLRequest(postTitles.selectedItem.link));" />
  11. </mx:Application>

I tried it locally, and no security error, of course. I loaded it onto my server, and I got the following error:

[RPC Fault faultString="Security error accessing url" faultCode="Channel.Security.Error" faultDetail="Destination: DefaultHTTP"] ...


So I went back to the Community MX articles I’d written, and lo and behold, the security error occurred with those applications as well. Strange.

So I browsed a few Flash Player 9 and Flash Player 10 security articles, and updated my crossdomain.xml policy file. Still the same error.

So I dug. I checked a few security technotes, even placed crossdomain files in every subdirectory which may have an impact (even though I knew a policy file on the root of the server was sufficient). No dice.

So I created the most permissive crossdomain policy file I could build, which included all the required XML elements:

  1. <?xml version="1.0"?>
  2. <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
  3. <cross-domain-policy>
  4.   <site-control permitted-cross-domain-policies="all" />
  5.   <allow-access-from domain="*" secure="false" />
  6.   <allow-http-request-headers-from domain="*" headers="*" secure="false" />
  7. </cross-domain-policy>

Still the security error. Okay, now it was serious pulling-out-of-hair time.

After a few deep breaths, and resisting the urge to throw large furniture, I did a walk around the block, and on my walk the solution came to me: maybe it was my feed URL?

I had appended all the feed URLs with “feed://” as I’d copied from my browser. So I deleted all these URL prefixes, so the feed read simply “http//www.joeflash.ca/blog/feed/”, and hot damn! It worked! In fact, after removing the policy file from the server as a test, and clearing the browser cache, I realized I didn’t even need the damn crossdomain file! Several hours later… sheeit. Major “DUH!” moment there… :)

So let my dumbass move be a lesson to you: don’t prefix your feed URL with “feed://” !!

Here’s the full RSS reader application, for anyone who’s interested:

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <mx:Application xmlns:mx="http://www.adobe.com/2006/mxml" layout="absolute"
  3.    pageTitle="Professional Flex 3 Team Blog Reader"
  4.    creationComplete="RSSFeed.send()">
  5.  
  6.    <mx:Script>
  7.       <![CDATA[
  8.          import mx.managers.CursorManager;
  9.       ]]>
  10.    </mx:Script>
  11.  
  12.    <mx:ArrayCollection id="blogData">
  13.       <mx:Object label="Joseph Balderson"
  14.          data="http://www.joeflash.ca/blog/feed/"/>
  15.       <mx:Object label="Peter Ent"
  16.          data="http://weblogs.macromedia.com/pent/index.xml"/>
  17.       <mx:Object label="Jun Heider"
  18.          data="http://www.iheartair.com/?feed=rss2"/>
  19.       <mx:Object label="Todd Prekaski"
  20.          data="http://feeds.feedburner.com/SimplifiedChaos?format=xml"/>
  21.       <mx:Object label="Tom Sugden"
  22.          data="http://blogs.adobe.com/tomsugden/index.xml"/>
  23.       <mx:Object label="Andrew Trice"
  24.          data="http://www.cynergysystems.com/blogs/rss/andrewtrice"/>
  25.       <mx:Object label="David Hassoun"
  26.          data="http://david.realeyes.com/?feed=rss2"/>
  27.       <mx:Object label="Joe Berkovitz"
  28.          data="http://joeberkovitz.com/blog/feed/"/>
  29.    </mx:ArrayCollection>
  30.  
  31.    <mx:HTTPService id="RSSFeed" url="{blogFeed.selectedItem.data}"
  32.       invoke="CursorManager.setBusyCursor()"
  33.       result="postTitles.selectedIndex=0;CursorManager.removeBusyCursor()"/>
  34.  
  35.    <mx:Panel id="reader" x="50" y="50" width="670" height="350"
  36.       title="Professional Flex 3 Team Blog Reader" verticalGap="0">
  37.       <mx:HBox width="100%" height="75%" top="0" horizontalGap="0">
  38.          <mx:List id="blogFeed" width="150" top="0" bottom="0"
  39.             dataProvider="{blogData}" selectedIndex="0"
  40.             change="RSSFeed.send()" height="100%"/>
  41.          <mx:List id="postTitles" labelField="title"
  42.             top="0" bottom="0" left="{blogFeed.width}" right="0"
  43.             height="100%" width="100%" selectedIndex="0"
  44.             dataProvider="{RSSFeed.lastResult.rss.channel.item}"/>
  45.       </mx:HBox>
  46.       <mx:TextArea width="100%" height="25%" bottom="0"
  47.          htmlText="{postTitles.selectedItem.description}" paddingTop="0"/>
  48.       <mx:ControlBar>
  49.          <mx:Canvas width="100%">
  50.             <mx:Button label="Go to blog post" left="0"
  51.                click="navigateToURL(new URLRequest(postTitles.selectedItem.link));" />
  52.             <mx:LinkButton label="Buy The Book" right="0"
  53.                click="navigateToURL(new URLRequest('http://tinyurl.com/profx3book'));" />
  54.          </mx:Canvas>
  55.       </mx:ControlBar>
  56.    </mx:Panel>
  57.  
  58. </mx:Application>

One Response to 'The RPC Fault Security Error that wasn’t'

Subscribe to comments with RSS or TrackBack to 'The RPC Fault Security Error that wasn’t'.

  1. Sudha said,

    on October 20th, 2010 at 4:00 am

    me too facing security error accessing url, even though i try to access data from same domain.

    i tried cross domain policy file too, but its still throwing the same!

    any idea to solve!

    Thanks in advance!

Leave a Reply