Abrupt YouTube security policy change
December 14, 2006 on 9:15 pm | In Flex, Programming, Uncategorized |There was a brief glitch in ReviewTube operation this last week, as the fallout from an unexpected YouTube security policy change.
Some links:
Possibly due to an exploit, they abruptly changed their crossdomain.xml file to only allow access from the youtube.com domain. As a result, YouTube developer API calls from Flash no longer work if the SWF was downloaded from a non-youtube.com domain. This broke a few aspects of ReviewTube that used that API.
I quickly got around the problem by proxying the YouTube requests through my own web server. Recall that ReviewTube was created to demonstrate an architecture for remote Flex applications. Well, in a validation of that architecture, it took changes to about 3 lines in 3 source files to make this change. Two changes were to code in the Service layer, and one change was to the component configuration file. (Full disclosure: also about 10 new lines of Rails code on the server side to do the proxying.)
So… we’re back live.
YouTube, if you want to be safe and not screw up Flash/Flex developers, please move your API to a different domain and put a liberal crossdomain.xml on that host. Thanks.
2 Comments »
RSS feed for comments on this post. TrackBack URI
Leave a comment
Entries and comments feeds.
Valid XHTML and CSS.
All content copyright (c) 2006-2007 Joseph Berkovitz. All Rights Reserved.
[…] Possibly due to an exploit, youTube abruptly changed their crossdomain.xml file to only allow access from the youtube.com domain. As a result, YouTube developer API calls no longer work if the SWF exists in a non-youtube.com domain. You can read more on this on Joe’s Blog here. […]
Pingback by Abrupt YouTube security policy change « FLEXing My Muscle — March 27, 2007 #
[…] They are obviously not using the Youtube API because Youtube blew that up by changing making a security policy change to the crossdomain.xml file needed to pull videos into Flex. So I did a little investigation. I found a site, in French, that had a Flash 8 application to basically screen scrape and decode the URL to Youtube videos. I migrated this over to Flex and created a small demo application. […]
Pingback by Flex Youtube Grabber — April 27, 2007 #