错误的证书名称会导致 Adobe Flash 电影中出现安全沙箱违规错误
我正在使用 HTTPS 测试 Adobe Flash 应用程序与服务器的通信。
如果我向 https://localhost 发出请求，一切都很好。但是，如果请求 url 设置为 https://192.168.0.1，则 URLLoader 会失败并出现以下流错误：
Error #2032: Stream Error. URL: https://192.168.0.1/path-to-script/
如果我在浏览器中调用该 URL，我会收到安全警告，我可以覆盖该警告（在Chrome）：
This is probably not the site you are looking for!
[Proceed anyways] [Back to safety]
当然，这是因为证书名称（“localhost”）与 IP 地址不匹配。
现在，是否可以忽略/抑制该警告/错误？例如，如果我使用 flash.net.Socket 类，是否可以？
更新
我现在做了更彻底的测试。
我已经使用的 crossdomain.xml：
<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" />
</cross-domain-policy>
工作场景：
Flash 托管在 http://www.domain 上并从 http://www.domain 加载-A.com
URLLoader 请求 https://www.domain-B.com/demo.html
不工作：
Flash 仍托管并从 http://www 加载。域名-A.com
URLLoader 向 https://{IP_OF_SERVER}/demo.html 发出请求
问题是，Flash 甚至不会加载 crossdomain.xml，因为“证书名称错误” “ 错误。 （由于该证书是为www.domain-B.com颁发的，而不是为IP地址颁发的）
具体错误消息：
*** 安全沙箱违规 ***
请求者从 http: 请求 https://{IP_OF_SERVER}/demo.html 上的资源： //www.domain-A.com/flash/demo.swf 由于缺乏策略文件权限而被拒绝。
要了解发生了什么：
在您的计算机中打开 https://65.54.186.107/浏览器（它是 https://login.live.com 的 IP）
要访问该网站，您必须确认/忽略警告。
“这可能不是您要找的网站！”在 Google Chrome 中
Firefox 中“此连接不受信任”
“该网站的安全证书有问题。”在 IE 中
...
我正在寻找一种方法来“忽略”Flash 中的此警告。
结论
如果没有办法告诉Flash忽略SSL“错误的证书名称”错误，我只能考虑深入研究flash.net.Socket 类。
还有其他想法吗？
I'm testing the communication of my Adobe Flash app to the server using HTTPS.
If I make the request to https://localhost everything's fine. But if the request url is set to https://192.168.0.1 the URLLoader fails with this Stream error:
Error #2032: Stream Error. URL: https://192.168.0.1/path-to-script/
If i call the URL in the browser I get a security warning, which I can override (in Chrome):
This is probably not the site you are looking for!
[Proceed anyways] [Back to safety]
Of course that's because the certificate's name ("localhost") doesn't match the IP address.
Now, is it possible to ignore/suppress that warning/error? e.g. is it possible if I would use the flash.net.Socket class?
UPDATE
I did more thoroughly tests now.
The crossdomain.xml I'm already using:
<?xml version="1.0"?>
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<allow-access-from domain="*" secure="false" />
<allow-http-request-headers-from domain="*" headers="*" />
</cross-domain-policy>
Working scenario:
Flash hosted on and loaded from http://www.domain-A.com
URLLoader request to https://www.domain-B.com/demo.html
Not working:
Flash still hosted and loaded from http://www.domain-A.com
URLLoader request to https://{IP_OF_SERVER}/demo.html
The problem is, that Flash doesn't even load the crossdomain.xml because of the "bad certificate name" error. (Caused by the fact, that the certificate is issued for www.domain-B.com, not for a IP adress)
The specific error message:
*** Security Sandbox Violation ***
Request for resource at https://{IP_OF_SERVER}/demo.html by requestor from http://www.domain-A.com/flash/demo.swf is denied due to lack of policy file permissions.
To get an idea what happens:
Open https://65.54.186.107/ in your browser (it's the IP of https://login.live.com)
To get to the website you have to acknowledge/ignore the warning.
"This is probably not the site you are looking for!" in Google Chrome
"This Connection is Untrusted" in Firefox
"There is a problem with this website's security certificate." in IE
...
I'm looking for a way to "ignore" this warning in Flash.
Conclusion
If there's no way to tell Flash to ignore SSL "bad certificate name" errors, I can only think of digging into the flash.net.Socket class.
Any other ideas?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我得出的结论是，这个问题无法解决。证书名称必须与域名匹配，否则通信将失败。
毕竟，这是一种安全措施。 （比较：网站也无法告诉浏览器忽略安全警告。）
只有 Adobe 也实现此类安全警告（在 Flash 的未来版本中）并让用户决定是否继续，证书可以颁发给另一个域名。
如果您必须使用 IP 地址而不是域名，您可以考虑购买颁发给 IP 地址而不是域名的证书：http://www.ssl247.com/ssl-certificates/type/ip-address
I came to the conclusion, that it can't be solved. The certificate name must match the domain name, otherwise the communication will fail.
After all, it's a security measure. (Compare: there's also no way for a website to tell the browser to override the security warning.)
Only if Adobe would also implement such security warning (in a future version of Flash) and let the user decide whether or not to proceed, the certificate could be issued to another domain name.
If you must use an IP address instead of the domain name you might consider buying a certificate issued to the IP address instead of the domain name: http://www.ssl247.com/ssl-certificates/type/ip-address
这都是关于域的。
https://localhost 和 https:// 192.168.0.1 不是同一个域。
您必须配置跨域策略才能接受本地主机。
[编辑]
在 https 服务器上尝试一下
Its all about domain.
https://localhost and https://192.168.0.1 are not the same domain.
You would have to configure your crossdomain policy to accept localhost.
[EDIT]
Try this on the https server
The_asMan 是对的，如果您要从主 swf 或主域上的 swf 访问另一个域上的 swf，则需要跨域策略。但我认为这里的问题是您试图通过路由器或网关 IP 建立与服务器的连接，在这种情况下这将不起作用。如果它在闪存内正常工作并且只是一个安全错误，那么您会期望看到安全沙箱违规错误，而不是流错误（无法建立连接）。使用您的本地地址进行测试，如果您想在另一台服务器上进行测试，请将其上传到网络服务器或其他服务器，但尝试使用您的网关地址是没有意义的，并且可能不起作用。如果您在本地计算机上运行像 Xampp 这样的服务器并使用本地主机地址进行测试，那么您就可以准确地执行此操作，并且可以期望您的应用程序与部署在 Web 服务器上的应用程序具有相同的功能。
以下是关于该错误的一些 NFO，与我所说的一致：
http://www.judahfrangipane.com/blog/2007/02/15/error-2032-stream-error/
The_asMan is right you need a crossdomain policy if you're accessing a swf on another domain from within your main swf or a swf on your primary domain. But I think the issue here is that you're trying to establish a connection to the server through your router or gateway IP and that will not work in this case. If it were working properly within flash and it was just a security error, then you would expect to see a security sandbox violation error, not a stream error (unable to establish connection). Test with your local address and if you want to test on another server then upload it to a web server or something but trying to use your gateway address just doesn't make sense and probably doesn't work. If you're running a server like Xampp on your local machine and testing with the localhost address, you're doing this accurately and can expect your application to function the same deployed on a web server.
Here's some NFO on that error that is in line with what I'm saying:
http://www.judahfrangipane.com/blog/2007/02/15/error-2032-stream-error/