Simeon Says

Technology

URLRequestHeader in AS3 Can Not Use Authorization Header

17 Jan 2008 Simeon  

17 Responses to “URLRequestHeader in AS3 Can Not Use Authorization Header”

1. on 17 Jan 2008 at 12:40 pm 1Ben

   Hi Simeon,

   My bad for listing Flash on the website; I blame my ActionScript ignorance

   - Ben

2. on 17 Jan 2008 at 12:56 pm 2Simeon

   Hey Ben,

   I wouldn’t say it was your bad at all. Your post made me think about if I could reach a larger audience with the lib.

   Now I want to know how its supposed to work without that header. i’ll find out more Cuz if the docs are right, my example shouldnt work at all.

   Thanks for the link BTW. Its really cool that you guys are so responsive. I hope fresh books does very well.

3. on 17 Jan 2008 at 8:58 pm 3David Brewer

   We’re struggling with this same question about the Authorization header being disallowed. From what I’ve seen on various forums, it seems that it used to work in earlier releases of Flash 9 but was added to the blocked list sometime relatively recently.

   I’m not sure exactly how one is meant to communicate with any kind of web service that uses HTTP Auth now. If you find a solution I’ll be very interested to hear about it.

4. on 17 Jan 2008 at 9:59 pm 4David Brewer

   Has anyone tried this library out that can report on how well it works?

   http://code.google.com/p/as3httpclientlib/

5. on 17 Jan 2008 at 10:23 pm 5Simeon

   I have not tried the lib, but I follow duck_typer’s blog. I think he is working on his own set of issues with flash before he can finish the library.

   I thought I would be smart tonight and just write a new class that extends the old one, but it doesnt seem to work. I wonder if URLRequestHeader is someone marked as final.

   I’ll keep digging.

6. on 17 Jan 2008 at 10:27 pm 6Simeon

   Of course if I had really read the docs I would have seen that it is final. So I can’t even fake it.

7. on 20 Jan 2008 at 6:20 am 7Maxim Porges

   One of my buddies and I battled with this a little bit on an app we’re working on, authorizing against a Rails REST API. He figured out a way to do authorization, although I can’t remember how.

   I’ll see if I can get him to post his findings.

   - max

8. on 20 Jan 2008 at 9:55 am 8Simeon

   Hey Max,

   I actually have this working right now, using flex. The problem is (as I have gleamed from harassing employees) that this is a change that occurred as part of the .115 flash player updates.

   And that moving forward the Authorization header will not be allowed. So now I am waiting to find out if there is a way to do this built in but not obviously. Or if we have to commit to helping the project listed above so our apps can continue to work.

9. on 25 Jan 2008 at 3:38 am 9Joeri Sykora

   Hello Simeon,

   I’m developing a Flex application that can manage a Blogger blog, which uses the Google Data API (http://code.google.com/apis/gdata/auth.html). However, to be able to add/edit/delete posts, I am required to set some value in the Authorization header on the request. Which of course doesn’t work, as you mention in your blog.

   From reading your last comment it seems you have found a workaround for this problem? Or do you perhaps no longer need the Authorization header in your API?

10. on 25 Jan 2008 at 7:08 am 10Simeon

    Hey Joeri,

    Actually not so much a work around as, it works in flex 2, and the beta of flex 3, but shouldn’t work when 3 gets released. It also doesn’t work in an AS3 only project in flex builder.

    So I am still working out how to get around this. I have an email to a couple folks at Adobe hoping to get some clarification.

11. on 26 Jan 2008 at 10:13 am 11Simeon

    Ryan Stewart pointed my to this technote which confirms “WHY” this doenst work.

    http://kb.adobe.com/selfservice/viewContent.do?externalId=kb403030&sliceId=2

    But the KB is not helpful in providing a work around or alternative solution.

12. on 26 Jan 2008 at 7:42 pm 12Simeon

    So it appears that the word from on high, is that this really has been disabled. The current work around is to use a different header name. This will only work if you also control the server you are connecting to.

    The other alternative is to implement another type of authentication for the API. Something like OAuth, or flickr’s token exchange might do.

    I’ll post back more if I sort something out. But I think this is closed for now.

13. on 28 Jan 2008 at 12:06 pm 13Simeon

    I have a new update for this posted here:

    http://blog.simb.net/2008/01/28/the-sky-is-falling-urlrequstheader-and-authorization/

    Problem is strictly related to Flash Player and does not affect the application security context of AIR applications.

    So if you target the browser you are still out of luck. However this functionality can still be utilized from within AIR.

14. on 15 Mar 2008 at 12:30 pm 14Danno

    I had a little AIR app working late last year that made a login request to google calendar api, got the seesion key and stuck it in the authentication header for subsequent interaction with the google calendar. Worked fine until Flex 3 arrived although it could be a Flash player issue. I used AIR in the first place to get around the browser cross domain issues that limited Flex browser apps.

    Now, even with AIR, and even for a POST method, I get the error:
    ArgumentError: Error #2096: The HTTP request header Authorization: cannot be set via ActionScript.

    Certainly, we need a means to access web apis needing authentication…google, yahoo etc. Has Adobe stated their position on this?

15. on 18 Mar 2008 at 6:30 pm 15Au Pair

    very nice web site. My English is not so good, so I do not understandt it well, but it seems very good. Thanks

16. on 04 Apr 2008 at 2:19 am 16Phil

    Hi,

    Did you guys find a workaround? Or news from Adobe?
    Phil

17. on 04 Apr 2008 at 6:18 am 17Simeon

    Hey Gang,

    While the issue is still a problem, Adobe recognized the issue and has provided a workaround in the April update to flash player. Please see this post for details.

    http://blog.simb.net/2008/03/18/april-flash-player-updates/

Leave a Reply

Name (required)

Mail (hidden) (required)

Website