Security issue blocks correctly requested and permitted content in Firefox

Question

Hi,Since upgrading to Windows 10, I am frantically searching for a means to debug - currently, out of four installed browsers, only Firefox supports debugger player correctly...Which would be ok, except...For Firefox, and only for Firefox, when using latest debugger plugin, content requests outside of the containing domain fail with a security violation without even _attempting_ to read the valid (and available) crossdomain.xml for that resource.In FIREFOX, I can read XML from feeds. where I have feeds./crossdomain.xml in placeIn FIREFOX,I CANNOT read JPG from img. despite having img./crossdomain.xml in placeIn _ALL_ other browsers, all assets are correctly requested and correctly displayed.HOW CAN I FIX THIS?GPS: In case it matters; Win 10, 64 bit.

Gaius Coffey · Accepted Answer

Ok, the ssl 3 thing was a red-herring.The crossdomain.xml is now fixed.I still cannot access the site...It looks as if there is a caching thing going on somewhere - we have removed the HSTS that was causing the redirect to HTTPS. I have cleared all site history and tried resetting the site DBs as per https://support.mozilla.org/en-US/questions/919498What I see now;1. In Private, I can access http2. In normal browsing, all requests are redirected to httpsThere are now probably three possibilities;1. I need to uninstall / reinstall Firefox (quick test) to clear everything2. The HSTS has somehow become lodged in an online system such as Akamai and needs to be flushed out3. ... something else ... I'll start with 1. because that's easy.OK, so what we have done to resolve this;1. Remove the root cause - HSTS entry on our asset domain forcing redirect to HTTPS2. On machines where the problem HSTS was cached and could not be resolved by the Firefox KB article;2.1. Uninstall Firefox2.2. Remove all traces of Firefox - delete C:\Users\\AppData\Local\Mozilla and C:\Users\\AppData\Roaming\Mozilla2.3 Reinstall FirefoxSo...That sucked.

jeromiec83223024 · Answer

The Flash Player security whitepaper has a good section on Cross-domain policy files.

White paper: Adobe Flash Player 10 security | Adobe Developer Connection

This article has good instructions on how to troubleshoot cross-domain policy failures:

Policy file changes in Flash Player 9 and Flash Player 10 | Adobe Developer Connection

See "User Logging" under the Workflows section.

The error messages are really explicit, so hopefully that's enough to get you on the right track.

If not, the error messages that you're logging, the relevant actionscript snippets and the contents of the relevant crossdomain.xml files (if they're not publicly accessible) would be really helpful in giving you useful advice.

Also, have you checked the JavaScript console? Some browsers block things like mixed-mode content loading. Are you doing anything else different in Firefox, like running ad blockers?

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.