For the soundwave360 site we decided to use Limelight to stream the audio. Once the audio was moved over to the Limelight CDN everything was streaming a lot faster. However there was one problem, flash was throwing a sandbox security error every time I used the computeSpectrum function to create the sound wave.

So here’s the deally. Any time you grab data from a directory that is not a sub directory of your swf you need a crossdomain.xml policy file in the root directory of the url that you are grabbing the data from. This is a very common thing and well documented in flash. But we already had a crossdomain.xml file in our limelight root directory, or so we thought. The URL of our limelight CDN is appended with some weird ID number. So the directory that stores our streaming files, and our crossdomain.xml file, is actually a subdirectory of the root.

Flash automatically looks at the root directory for the crossdomain.xml file before loading any external content. But what if your policy file exists in a subdirectory like ours? Use the Security.loadPolicyFile function. Just specify this first thing before writing any other code, maybe in your document class. Flash will wait for any crossdomain policy files to load before loading any external data, so no event handlers are needed, not that there are any for this function.

Here’s what it should look like in your document class(AS3):

package com.mysite {

import flash.display.MovieClip;
import flash.system.Security;

public class MyDocumentClass extends MovieClip {
public function MyDocumentClass():void {
Security.loadPolicyFile("http://www.mysite.com/somefolder/crossdomain.xml");
}

}

}

The computeSpectrum function needs access to the data of the sound that you are loading. Because of this, a simple crossdomain.xml file will not give you permission to use this function. Rather it should look like this:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*" secure="false" to-ports="*">
</cross-domain-policy>

Without this file you will still be able to load, play and stop the sound, but you wont be able to access any of its data like the id3 information or the byte information, which computeSpectrum needs.