1

I know I am asking a dumb question here, but pardon me, I am learning.

I found two questions viz, How do I access cookies within Flash? and How to Make a button send an email using AS3 automatically. My question is, If I create a flash file with the above functionalities and upload that flash to some web applications like facebook or twitter, ideally I would be able to grab the cookies of other users in mailbox. What security feature is implemented in such cases to prevent this?

Improve this question

1 Answer 1

Reset to default
1

Looking at your first link, flash is using javascript to read the cookie. Assuming that's the way you implement it, you are back to the usual cookie security restrictions:

  • Same domain restrictions - the browser will only send cookies in the same domain, so *.foo.com cookies will only ever be sent to *.foo.com URLs. You would not be able to read a *.facebook.com cookie from foo.com
  • HttpOnly flag - the cookie will only be sent over http/https connection and is not available to javascript. This would prevent your flash app reading any cookie with this flag.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .