Dynamic Flash

FileReference.upload doesn’t support custom headers

Monday, 14 January 2008

At work we're working on an application that makes heavy use of the FileReference.upload() method to upload files to the server. We recently had a change request to add some custom HTTP headers to the upload request, which I didn't think would be a problem. I was wrong.

When using the FileReference.upload() method to upload a file to a server, you can specify additional variables to be sent along with that upload request by means of a URLRequest object like so:

PLAIN TEXT

Actionscript:

// Create new request object and point it at the right URL
var request:URLRequest = new URLRequest();
request.url = "/upload.php";
// Specify additional variables to be sent with request as POST data
request.method = URLRequestMethod.POST;
request.data = new URLVariables();
request.data.foo = "bar";
// Upload file using data from request object
fileRef.upload(request);

Since you can send custom headers using the URLRequest object's requestHeaders property, I should have been able to specify custom headers for my file upload request fairly easily:

PLAIN TEXT

Actionscript:

// Create new request object and point it at the right URL
var request:URLRequest = new URLRequest();
request.url = "/upload.php";
// Specify additional variables to be sent with request as POST data
request.method = URLRequestMethod.POST;
request.data = new URLVariables();
request.data.foo = "bar";
// Specify additional headers to be sent with request
var header:URLRequestHeader = new URLRequestHeader('X-Test-Header', 'Hello');
request.requestHeaders.push(header);
// Upload file using data from request object
fileRef.upload(request);

Sadly, the above code doesn't work. I checked the raw request and response using Charles and the custom X-Test-Header I was trying to send just wasn't coming through. I tried a number of different variations of the same code, all with the same result.

The problem, I have just discovered, is that there are a number of restrictions placed on the URLRequest object when used in conjunction with the FileReference methods. One of these restrictions is that the requestHeaders property is completely ignored when using the FileReference.upload() method, so it's impossible to send custom HTTP headers along with a file upload.

To be completely fair to Adobe, this and the other restrictions are stated quite clearly in the documentation for the URLRequest object:

The FileReference.upload() and FileReference.download() methods do not support the URLRequest.requestHeaders parameter.

Since I can't see any security or technical reason why the URLRequest object should be restricted in this way, I'm off to file a bug with Adobe to see if we can get this addressed in a future version of the Flash Player.

Lesson learned: RTFM.