External, cross-domain mp3 won't load in Flash player (google Text-To-Speech)

Question

I want to play Google Text-To-Speech URL in Flash player on my webpage.

I am using http://www.alsacreations.fr/dewplayer.html but it doesn't work:

<object type="application/x-shockwave-flash" data="dewplayer.swf" width="200" 
        height="20" id="dewplayer" name="dewplayer">
<param name="wmode" value="transparent" />
<param name="movie" value="dewplayer.swf" />
<param name="flashvars" value="mp3=http://translate.google.com/translate_tts?q=hello-word&tl=en" />
</object>

Answer 1

The URL of you MP3 file must be URL-Encoded (http://www.w3schools.com/tags/ref_urlencode.asp)

<object type="application/x-shockwave-flash" data="dewplayer.swf" width="200" height="20" id="dewplayer" name="dewplayer">
<param name="wmode" value="transparent" />
<param name="movie" value="dewplayer.swf" />
<param name="flashvars" value="mp3=http%3A%2F%2Ftranslate.google.com%2Ftranslate_tts%3Fq%3Dhello-world%26tl%3Den" />
</object>

Answer 2

I have made an intensive research and found some solutions. The conclusion made by Mathieu's (that google changes arguments and you have to write your own app) is wrong. The problem is that google checks for cross-domain access. It is not regulated via Adobe Flash player crossdomain.xml as in this case, surprisingly. Flash player doesn't attempt to load that file from server root directory (tested in Firebug).

The problem is that google is checking for referer, and if that is set, it refuses to load the content, please check:

• external reference to mp3 file - normal site - works
• external reference to mp3 file - google translate - doesn't work, as referer is checked
• google translate directly - works, no referer sent (beware! After this, the above link will also work, as the mp3 file will already be in cache!)

So the problem boils down to referer spoofing for inline content.

Solution 1 - RefererKiller

You can use a simple trick: refer to the mp3 file in <img src=""> tag, see my example, with added referer spoofing. Then the flash player will not have to download it, since it will be in cache already. There are solutions to remove referer from inline content (see RefererKiller implementation for images). However, comment suggests the cross-browser compatibility might be an issue.

Solution 2 - https

So, the simplest solution is to use https protocol - clear your cache and try the above link with https added. Referer will not be set for inline content. But, if you don't have trusted certificate, you probably don't want your users to go through the terrible 4-click process to confirm the trust in your certificate. In that case, you probably want go for another solution.