Security Error

Hi,
I'm attempting to host my pano images on a content delivery network, specifically Rackspace Cloudfiles, which is on a different domain to where krpano is hosted. I get this error in krpano player for each of the images:

ERROR: Security Error - "http://cxxxxx.cdn.cloudfiles.rackspacecloud.com/filename.jpg"

My XML looks like this:

<image type="CUBE" multires="true" tilesize="579">
		<level tiledimagewidth="3183" tiledimageheight="3183">
			<left  url="http://cxxxxx.cdn.cloudfiles.rackspacecloud.com/l3_l_%0v_%0h.jpg" />
			<front url="http://cxxxxx.cdn.cloudfiles.rackspacecloud.com/l3_f_%0v_%0h.jpg" />
			etc.

I thought it may be a cross-domain problem so I added this to my XML:

<security>
	<allowdomain domain="*" />
</security>

That didn't fix the problem, so I tried this:

<security>
	<crossdomainxml url="http://www.mysite.com/crossdomain.xml" />
</security>

...with this in the crossdomain.xml file:

<?xml version="1.0"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
  <allow-access-from domain="*"/>
</cross-domain-policy>

...no joy.

I'm confused about where the crossdomain.xml is supposed to go. Some threads in the forum say "on the other server" some say "root of your server". I've tried both, but the problem persists.

Has anyone attempted a similar thing with a CDN, perhaps Amazon S3 or similar?

Any suggestions much appreciated.

Thanks,
Andrew

Hi Klaus,
yes, crossdomain.xml resides in the same CDN container as the image files. I found this article by RackSpace http://cloudfiles.rackspacecloud.com/index.php/Simple_Flash_Examples and have used the same crossdomain.xml file they suggest, but I still get the security errors.

crossdomain.xml

<?xml version="1.0"?>
 <!DOCTYPE cross-domain-policy SYSTEM"http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"> 
  <cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only"/>
   <allow-access-from domain="*"/>
   <allow-http-request-headers-from domain="*" headers="SOAPAction"/>
  </cross-domain-policy>

It looks like it may be a problem on the krpano player / XML side.

I have a krpano plugin that launches videos from a menu. It uses its own XML config file to get the URLs of the videos. I have now set the URLs of the videos to their respective locations in a container on the CDN and they all load perfectly.

I found the problem. The cross-domain policy file uploaded as application/octet-stream to the CDN container, a symptom of Rackspace's browser-based upload utility I'm guessing. I deleted the policy file and uploaded another through FireUploader so it now has the correct mime type of text/xml. All works perfectly.

I'm still baffled as to why the policy file I used in the video container that has an app/octet-stream mime type works for the videos loaded by the plugin