General Development
Sign In  ·  Help
Force.com Discussion Boards : Developer Boards : General Development : Re: Security Sandbox Error with Flex/Air 1.0 toolkit
   Reply    Reply   
 
   Message Listing    Message Listing   
   Previous Thread    Previous Thread   
   Next Thread    Next Thread   
Jump to Page:   1 · 2  |  Next Page
  Reply   Reply  

Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
simonjpalmer
Regular Contributor
Posts: 22

simonjpalmer

Message 1 of 12

Viewed 4,658 times


I have been connecting to sf.com to read data for more than a year from my app and suddenly tonight it has stopped working.

I have the following exception (I have deliberately removed the username and password, but I have checked that they are correct and refer to the latest security token. 

This was working fine erlier today and I have changed no code...

Method name is: login
'A997F86A-36E9-DDDC-EC6B-BBEE23101466' producer connected.
'A997F86A-36E9-DDDC-EC6B-BBEE23101466' producer sending message 'B89E5879-D7F7-E91E-2082-BBEE231054DD'
'direct_http_channel' channel sending message:
(mx.messaging.messages::HTTPRequestMessage)#0
  body = "<se:Envelope xmlns:se="http://schemas.xmlsoap.org/soap/envelope/"><se:Header xmlns:sfns="urn:smileytongue:artner.soap.sforce.com"/><se:Body><login xmlns="urn:smileytongue:artner.soap.sforce.com" xmlns:ns1="sobject.partner.soap.sforce.com"><username>simon.palmer@*****.com</username><password>*****</password></login></se:Body></se:Envelope>"
  clientId = (null)
  contentType = "text/xml; charset=UTF-8"
  destination = "DefaultHTTPS"
  headers = (Object)#1
  httpHeaders = (Object)#2
    Accept = "text/xml"
    SOAPAction = """"
    X-Salesforce-No-500-SC = "true"
  messageId = "B89E5879-D7F7-E91E-2082-BBEE231054DD"
  method = "POST"
  recordHeaders = false
  timestamp = 0
  timeToLive = 0
  url = "https://www.salesforce.com/services/Soap/u/11.0"
Method name is: login
*** Security Sandbox Violation ***
Connection to https://www.salesforce.com/services/Soap/u/11.0 halted - not permitted from https://localhost/pm_server/pm/pm-debug.swf
'A997F86A-36E9-DDDC-EC6B-BBEE23101466' producer acknowledge of 'B89E5879-D7F7-E91E-2082-BBEE231054DD'.
'A997F86A-36E9-DDDC-EC6B-BBEE23101466' producer fault for 'B89E5879-D7F7-E91E-2082-BBEE231054DD'.
Comunication Error : Channel.Security.Error : Security error accessing url : Destination: DefaultHTTPS
Error: Request for resource at https://www.salesforce.com/services/Soap/u/11.0 by requestor from https://localhost/pm_server/pm/pm-debug.swf is denied due to lack of policy file permissions.

What has changed?
11-20-2008 02:09 PM

All Users' Tags:

  
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
JBirk
Contributor
Posts: 6

JBirk

Message 2 of 12

Viewed 4,647 times


I was seeing the same thing this morning. I thought I had checked out the crossdomain.xml not a week ago and it was was wildcarded to open, but now it seems limited to handful of domains.
11-20-2008 02:57 PM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
jeffdonthemic
Regular Contributor
Posts: 138

jeffdonthemic

Message 3 of 12

Viewed 4,599 times


Unfortunately this is a known bug that Salesforce is working on. It only affects users of the Flash 10 player. I spoke with the Flex product manager as Dreamforce and alerted him of the problem. They applied a patch last Friday that fixes the problem but only if you are running the SWF from a Salesforce server. If you run the SWF from a non-Salesforce server you still receive the error.

I spoke with the product manager again yesterday and he has reopened the case. Hopefully it will be fixed soon.

Jeff Douglas
Informa Plc
blog.jeffdouglas.com
11-21-2008 06:19 AM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
simonjpalmer
Regular Contributor
Posts: 22

simonjpalmer

Message 4 of 12

Viewed 4,596 times


Thanks for the information.  Do you have a ticket number so I can contact them myself?
11-21-2008 07:08 AM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
jeffdonthemic
Regular Contributor
Posts: 138

jeffdonthemic

Message 5 of 12

Viewed 4,585 times


The case is: 02236361
 
Jeff Douglas
Informa Plc
blog.jeffdouglas.com
11-21-2008 08:18 AM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
simonjpalmer
Regular Contributor
Posts: 22

simonjpalmer

Message 6 of 12

Viewed 4,561 times


I thought this was the problem but I am using 9.0 r124 so either it is not limited to 10 or there's something else at play. 

I immediately blamed my own code and account credentials, but having re-checked that nothing changed I am now sure that it is not them.  I have reverted back to production code which has been working since February 2007 and that throws the same exception, so there must be something else.
11-21-2008 12:15 PM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
Moderator DevAngel
Moderator
Posts: 3185

DevAngel

Message 7 of 12

Viewed 4,561 times


So, there are lots of possible combinations of security settings, endpoint settings and so on that affect the communication between a Flex app (SOAP API) and the platform. 

First, there is a missing x-domain file at www.salesforce.com/service/Soap/u.  This file is required to allow your flex application to set the appropriate required html headers for the SOAP messages.  We have a fix in progress and expect resolution by early next week.

Still, even with that in place, there are other considerations that you have control over that affect accessibility to the platform. Specifically, if you are hosting your swf on a non-ssl enabled server (http), you must do two things to enable the toolkit.  First, you need to set the "protocol" attribute of the connection object to "http" and set the server url to "http://www.salesforce.com/services/Soap/u/14.0".  If you don't make this setting the toolkit will default back to ssl (https).  Second, you will need to check to make sure that your salesforce.com instance is configured to allow non ssl connections.  You can do this by going into Setup and under Administration Setup/SessionSettings verify that the check box next to "Require secure connections" is unchecked.  When that box is checked, no matter what method you use to access the platform (web or api) you must us https.

The reason that you need to allow http connections if you are hosting from a non ssl site is because the flashplayer security will not allow mixed security (AFAIK).

Hope this helps.


Cheers

 

Dave
Developer Evangelism
BLOG - blog.sforce.com

Follow me on twitter @dcarroll

11-21-2008 12:45 PM

All Users' Tags:

  
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
jeffdonthemic
Regular Contributor
Posts: 138

jeffdonthemic

Message 8 of 12

Viewed 4,549 times


Thanks for the helping me out with this issue Dave! Outstanding customer support from Salesforce as usual. How often would you get someone from SAP to give you a ring concerning a problem? [No reply needed..... everyone knows the answer.]

Jeff Douglas
Informa Plc
blog.jeffdouglas.com
11-21-2008 12:55 PM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
JBirk
Contributor
Posts: 6

JBirk

Message 9 of 12

Viewed 4,538 times


Thanks Dave.  Is there still a Flash 10 versus Flash 9 player issue as well?
11-21-2008 03:40 PM
 
  Reply   Reply  

Re: Security Sandbox Error with Flex/Air 1.0 toolkit
Options    Options  
simonjpalmer
Regular Contributor
Posts: 22

simonjpalmer

Message 10 of 12

Viewed 4,514 times


Thanks for the response.  I am aware of the HTTPS problem and have matched the protocols (if you look at the exception trace I posted you'll see that I am using an HTTPS server at my end). 

It sounds to me more like the problem with the crossdomain security policy.

I'm intrigued to know why this has suddenly happened.  Was there a change at the salesforce.com end?  If yes, how do I keep abreast of such changes so I can avoid this in the future.

I now have no production environments working, a lot of upset customers and no firm date to tell them that it will be fixed.  How do I escalate issues like this?
11-22-2008 12:12 AM
 
Jump to Page:   1 · 2  |  Next Page
 
   Message Listing    Message Listing   
   Previous Thread    Previous Thread   
   Next Thread    Next Thread   

  Search Board       User Search  ·  Advanced