Setting Custom HTTP Headers in Flash

I needed to set a custom HTTP header in Flash. ActionScript 3 makes this easy, or so I thought. Here was my original prototype code:

import flash.net.navigateToURL;
private function href(url:String):void
{
	var req:URLRequest = new URLRequest(url);
	var header:URLRequestHeader = new URLRequestHeader("Koostoom", "tmttos");
	req.requestHeaders.push(header);
	navigateToURL(req);
}

Like I said, this is easy. To verify it was working, I wrote a quick prototype using PHP:

$headers = getallheaders();
foreach ($headers as $name => $value) {
   echo "[$name] = $value<br/>\n";
}

I think I copied this out of the PHP manual pretty much. So I tested the above code and everything worked, right? I wouldn't be writing this post if that was the case!

I tried the above in Firefox and Safari. My usual test plan is to make sure it works in those two browsers first, and then deal with IE. In this case it didn't work in either browser. I knew that some HTTP headers were off-limits in Flash, so just for just kicks I tried changing Koostom to Referrer. This should have caused an exception, but of course it didn't. It did nothing.

Finally, I found the answer through experimentation. You have to do an HTTP POST with form data in order to get the custom header sent:

import flash.net.navigateToURL;
private function href(url:String):void
{
	var req:URLRequest = new URLRequest(url);
	// begin stupid hack
     req.method = "POST";
	var formVars:URLVariables = new URLVariables();
	formVars.blah = "blue";
	req.data = formVars;
     // end stupid hack
	var header:URLRequestHeader = new URLRequestHeader("Koostoom", "tmttos");
	req.requestHeaders.push(header);
	navigateToURL(req);
}

Now the PHP script showed my Koostoom header...

I don't know if this is a bug with the Flash player, or the browsers. I don't think it is part of the HTTP spec, i.e. I think custom headers are just as valid in an HTTP GET as in an HTTP POST.

Flash and HTTP Headers Redux

A few months ago I wrote about the lack of access to HTTP headers in Flash. I recently came across some other people talking about this. This has caused debate about Flex being able to support REST.

The opinion seems to be that Adobe does not allow this because not all browsers will provide this information to the Flash player. I have not seen a list of what browsers have this limitation, though I will speculate it must be older versions of popular browsers... Some of the evidence of this is that this is provided in AIR. In AIR, it is the runtime itself that makes HTTP requests. In a SWF running in a browser, the runtime relies on the browser. So restrictive browsers could be an issue on a SWF, but never for an AIR app.

Could another reason be security? In particular, cookies are passed back-and-forth via HTTP headers. There are numerous cases of cookies being stolen by malicious JavaScript, which has total access to HTTP headers. Adobe made a lot of significant security improvements between Flash Player 8 and 9. In a world of mashups, are they better off continuing to deny access to HTTP headers?

All of that being said, I recently ran across another case where this causes problems. I had a SWF that could be loaded by two different pages. It needed to show slightly different features depending and have a different look and feel depending on what page it was on. The easiest thing to do would have been for it to "know" what page was loading it by looking at the referrer on the HTTP request that loaded the SWF. This is a header of course, and thus not available. Instead a FlashVar could be passed in to tell the SWF what to show. That's a better way to do it, but required changing the code of the page hosting the SWF, which was not an option. The hack that had to be used was to have to logical copies of the same SWF, foo_A.swf an foo_B.swf. The SWF could then look at its this.loaderInfo.URL to figure out what to show.

HTTP Request Headers and Flash

I've been doing a lot of Flash/Flex work over the past few months. I recently had a colleague ask me if a SWF embedded in a page has access to the cookies for that domain. I knew the answer was no, and said as much. Then I started thinking, that just seems wrong. Why doesn't a SWF have access to cookies, and for that matter, all the HTTP headers that were sent as part of the request for the SWF?

It's easy to create a simple page with a SWF embedded in it and load up Firebug to watch the HTTP traffic. I created a simple two page app to experiment with this. On the first page, I used so JavaScript to write a cookie. By the way, this is annoyingly mundane. I know there are JS libraries for abstracting this and providing a clean API, but you would think that IE or Mozilla would have added an extension to JavaScript that does exactly this. Having to do document.cookie.indexOf(...) and document.cookie.substring(...) all the time is just ridiculous.

Back to the app. After setting some cookies, there is a link that goes to page two. Page two includes an embedded SWF. Watching the traffic on page two, I could clearly see cookies, user-agents, referrers, etc. all being sent as part of the HTTP request for the SWF. One interesting thing is that the referrer was page two, not page one. That makes sense, though.

So everything is clearly there, it's just not available to the SWF runtime. Any parameters on the query string are available. In Flex you can get to them using Application.application.parameters. This gives you a classic ActionScript Object, i.e. an associative array. So if you put the URL for the SWF as http:///widget.swf?foo=bar then you can write AS code like Application.application.parameters.foo. So not all of the HTTP request is being thrown away, though the headers certainly are.

All I can think of is that this is a security issue. It creates other potential security problems though. Imagine if page one in my app was a login page, and page two was some kind of personalized home page. A lot of websites use cookies for authentication, and that authentication is not being passed to the SWF. What's a developer to do? There are lots of options, but you can imagine some very unsavory and horribly insecure ones.

Anyways, I thought maybe I was wrong all along, and just didn't know what I was talking about. It certainly wouldn't be the first time, and especially considering I didn't know any Flash 12 months ago. So I posted the question on Flexcoders... It's been about 24 hours with no responses, which usually means nobody knows the answer.