FileReference.upload doesn’t support custom headers

Monday, 14 January 2008

At work we’re working on an application that makes heavy use of the FileReference.upload() method to upload files to the server. We recently had a change request to add some custom HTTP headers to the upload request, which I didn’t think would be a problem. I was wrong.

When using the FileReference.upload() method to upload a file to a server, you can specify additional variables to be sent along with that upload request by means of a URLRequest object like so:

// Create new request object and point it at the right URL
var request:URLRequest = new URLRequest();
request.url = "/upload.php";
 
// Specify additional variables to be sent with request as POST data
request.method = URLRequestMethod.POST;
request.data = new URLVariables();
request.data.foo = "bar";
 
// Upload file using data from request object
fileRef.upload(request);

Since you can send custom headers using the URLRequest object’s requestHeaders property, I should have been able to specify custom headers for my file upload request fairly easily:

// Create new request object and point it at the right URL
var request:URLRequest = new URLRequest();
request.url = "/upload.php";
 
// Specify additional variables to be sent with request as POST data
request.method = URLRequestMethod.POST;
request.data = new URLVariables();
request.data.foo = "bar";
 
// Specify additional headers to be sent with request
var header:URLRequestHeader = new URLRequestHeader('X-Test-Header', 'Hello');
request.requestHeaders.push(header);
 
// Upload file using data from request object
fileRef.upload(request);

Sadly, the above code doesn’t work. I checked the raw request and response using Charles and the custom X-Test-Header I was trying to send just wasn’t coming through. I tried a number of different variations of the same code, all with the same result.

The problem, I have just discovered, is that there are a number of restrictions placed on the URLRequest object when used in conjunction with the FileReference methods. One of these restrictions is that the requestHeaders property is completely ignored when using the FileReference.upload() method, so it’s impossible to send custom HTTP headers along with a file upload.

To be completely fair to Adobe, this and the other restrictions are stated quite clearly in the documentation for the URLRequest object:

The FileReference.upload() and FileReference.download() methods do not support the URLRequest.requestHeaders parameter.

Since I can’t see any security or technical reason why the URLRequest object should be restricted in this way, I’m off to file a bug with Adobe to see if we can get this addressed in a future version of the Flash Player.

Lesson learned: RTFM.

Categories
ActionScript, Flash, Flex 2, Flex 3
Tags
, , , , , ,

« Foundation ActionScript 3.0 now available foundationas3.com has launched »

8 responses

flash player 9 support it in swfupload you can

jiayin | Friday, 29 February 2008 | 10:37 am

flash player 9 support it in swfupload you can see the as source of swfupload flash9.0 version

jiayin: The above code is ActionScript 3.0 targeting Flash Player

Steve | Friday, 29 February 2008 | 11:06 am

jiayin: The above code is ActionScript 3.0 targeting Flash Player 9. According to the latest URLRequest.requestHeaders documentation still doesn’t work with FileReference.upload.

I’ve had a look at the swfupload source code and I can’t see anything in there that adds custom headers to a file upload.request.

You are right. This is a real problems. The Filereference.upload doesn't

icao | Friday, 06 June 2008 | 11:47 am

You are right. This is a real problems. The Filereference.upload doesn’t send any Header to the server if you don’t use IE with windows. All the information here:

https://bugs.adobe.com/jira/browse/FP-78

While this is a little late to be useful, I

Jackson Gabbard | Friday, 03 October 2008 | 2:27 am

While this is a little late to be useful, I figured for the web searchers like myself encountering this issue for te first time as well, that custom headers aren’t the only way to get additional info to the server along with binary data.

Cookies are always sent along with requests, so if you setup an ExternalInterface method to update a cookie via JS, you can read the cookie data on the server side.

This is partly off topic. I want to use

Alejandro Gonzalez | Sunday, 26 October 2008 | 4:04 pm

This is partly off topic. I want to use a file reference to upload custom binary data (ie a file built within flash) rather than a physical file from my disk. Do you know if it can be done? I’m currently achieving it through a URLLoader object, but it has a huge problem: There is no upload progress events :/ I read the file reference does dispach this events, so I was wondering…. Any help would be appreciated.

Hi, with regards to FileReference.upload(), is there a possible way

kristian | Wednesday, 26 November 2008 | 12:17 pm

Hi, with regards to FileReference.upload(), is there a possible way we can control it with html form button ( javascript to actionscript – ExternalInterface )?

Yup - ran into this exact problem with FileReference.download : http://livedocs.adobe.com/flash/9.0/ActionScriptLangRefV3/flash/net/FileReference.html#download() "The

Mike | Wednesday, 11 March 2009 | 4:47 pm

Yup – ran into this exact problem with FileReference.download :

http://livedocs.adobe.com/flash/9.0/ActionScriptLangRefV3/flash/net/FileReference.html#download()

“The requestHeaders property of the URLRequest object is ignored; custom HTTP request headers are not supported in uploads or downloads. [1/20/09: Added]“

I’m confused why: 1. Some of the headers are restricted in URLRequest (particularly content negotiation headers) 2. Why the headers from the URLRequest object are ignored.

Browser technologies are going to remain ditry if we don’t have adequate tooling to build clients that are actually capable of talking HTTP properly.

I tested the flash uploader in gmail. when I used

Velu | Thursday, 14 May 2009 | 7:45 pm

I tested the flash uploader in gmail. when I used Fiddler to monitor what is being sent from the flash, I was able to see that the cookies are being sent by the google flash uploader. Following is the extract from the Fiddler. I am not sure how google was able to pull this off…

Cookie: S=gmail=VeAADcwJC8m0HQtxLMthQQ:gmproxy=nx8A_QRXaIi8xlkBJJw9kA:gmproxy_yj=vsiqs6ID2tnLX-Z9jjuu8w; PREF=ID=218969f9c4f2b3fd:U=bcc1ecba42ba2f51:TM=1241563492:LM=1241635374:GM=1:S=0JJm5YFr6Sxlb9kk; NID=22=kRjw_h1yad4n5wde6VNvVe-TgR-yOXT-orVCrpePwz-Sl55jx6AIhXyy1qRBIp2KcnMEAs1bA1y2KaT6B47xFvFRKBiIynX0DuUKfGeS-Vqs2_QOU227L-0owi-Lu3RP