ExternalInterface.call works, but javascript can't access actionscript callbacks?

Question

In a webpage, javascript & as3 are setup like this:

1. Javascript loads the swf in the page.
2. swf calls ExternalInterface.call("javascriptFunctionName", "");
3. Javascript's javascriptFunctionName() uses actionscript functions set up by ExternalInterface.addCallback

Currently, javascriptFunctionName() starts by checking that it has access to the actionscript's callback functions.

Is this check necessary? Or does the fact that the actionscript managed to call the javascript function indicate that access is granted?

Edit: To be more specific, my code works. I'm worried that it may be put in a third party page with different permissions.

Answer 1

There are a few different scenarios for JavaScript/Flash communication with different security requirements.

• The protocol and domain of the SWF and HTML match.

  JavaScript can communicate with Flash.

  Flash can communicate with JavaScript if the param allowScriptAccess is set to "sameDomain" (default) or "always".

  For example, http://example.com/a.swf is loaded on http://example.com/a.html

• The domain of the SWF and HTML differ.

  JavaScript can communicate with Flash if Security.allowDomain(exactDomain) or Security.allowDomain('*') is called from Flash.

  Flash can communicate with JavaScript if the param allowScriptAccess is set to "always"

  For example, http://swf.example.com/a.swf is loaded on http://example.com/a.html

• The SWF is served over HTTPS, but the HTML is served over HTTP.

  JavaScript can communicate with Flash if Security.allowInsecureDomain(exactDomain) or Security.allowInsecureDomain('*') is called from Flash.

  Flash can communicate with JavaScript if the param allowScriptAccess is set to "always"

  For example, https://example.com/a.swf is loaded on http://example.com/a.html

To answer your question of whether it's necessary to check whether communication is working, the answer is probably yes if you want to show an error message right away. Either way, I would use a try..catch around each call on both sides.

Answer 2

JS to AS3 and AS3 to JS are separate behaviours so just because its working in one direction, doesnt mean it is working in the opposite direction.

To allow JS to call AS3 methods within the SWF, you need to register each AS3 method by calling ExternalInterface.addCallback - once for each AS3 method that you wish to call from JS.

Say you have an AS3 method like so:

function myFunction(value:String):void
{
    //do something here
}

You first need to register it:

//first parameter is name of function to use in JS.
//second parameter is the AS3 function itself.
ExternalInterface.addCallback("myAS3function", myFunction);

Then you can call it from JS; eg:

document.getElementById('mySWF').myAS3function("Hello World");