The only hitch I met was that I couldn’t create cross domain cookies this way as I was hitting the same domain policy. However as pointed out in the comments, it is possible, and simple too… I just needed to add…

Security.allowDomain("*");

Well, as I was editing my simple library, I came across a gem of a Javascript library that is better written and was open sourced.
The library can be found on the site, nfriedly.com.

Couple of points, you should probably use some flash detection when working with this as it uses Actionscript 3.0. This is only available from Flash version 9.0.31. I used featureblend.com‘s most excellent compressed Javascript library.

Depending on your usage of the library, you may need to edit the Javascript to fix a couple of bugs. The library uses document.body.appendChild() which when used while dynamically loading the library, will cause Internet Explorer 7 to calf.

Simple fix is to either use document.write to insert a div into the dom and use this element or use an existing one to append to.

Also found while using dynamic loading, that if there is a timeout caused (from not being able to connect to the Flash file) and the SwfStore object is not initialized, it will throw an error as it tries to access the SwfStore methods.

Another simple fix is to add a check that it is defined…

this._timeout = setTimeout(function () {
            if ( typeof SwfStore!=="undefined" && typeof SwfStore[namespace]!=="undefined" ) {
            	SwfStore[namespace].log('Timeout reached, assuming the store.swf failed to load and firing the onerror callback.');
            	if ( typeof SwfStore[namespace].config.onerror !== "undefined" ){
            		SwfStore[namespace].config.onerror();
            	}
            }
        }, timeout * 1000);

Anyways, love coming across libraries like this as it saves me a bunch of time. Check it out, it’s almost certainly what you need

LSO’s are like cookies and are sometimes referred to flash cookies but there are 2 main differences between them. A normal HTTP cookie can store around 4k of data, while the flash cookie can store up to 100k. Also a normal cookie is pretty easy to remove while removing a flash cookie is far more convoluted, which is a matter of some contention.

HANDY TIP: Removing LSO’s from your computer
You can remove LSO’s using a tool on Adobe site, here, which also allows you to configure your flash security settings. You can also install a Firefox plugin, Objection, which will allow you to see and remove whatever flash cookies are present on your computer.

I wanted to set a flash cookie using JavaScript. This is pretty straightforward thanks to Flash’s ExternalInterface class. This class allows you to set methods that can be accessed from an external script, like JavaScript. This class is bi-directional, so you can also call JavaScript methods from within the Flash’s ActionScript.

I used the site, viget and peachpit, to get an idea how to set this up and found some excellent, quirky tips from the schillmania site.

On my web page I needed to reference a neat SWFObject class to embed a flash player on the page. Once I had a handle on the flash player, I can call the Flash file’s ActionScript methods to request and set the LSO. The actionscript.org site has a good tutorial on how to manage LSO’s using ActionScript.

So here’s the JavaScript…

var lso_value;

function init() {
	var so = new swfobject.embedSWF("pd_check.swf", "pd_check", "1", "1", "9.0.0");
	so.write("flash_container");
}

function getFlashMovie( movieName ) {
	var isIE = navigator.appName.indexOf("Microsoft") != -1;
	return (isIE) ? window[movieName] : document[movieName];
}

function requestLSOValue() {
	getFlashMovie('pd_check').requestLSOValue();
}

function updateLSOValue( value ) {
	lso_value = value;
}

function setLSOValue( value ) {
	getFlashMovie('pd_check').setLSOValue( value );
}

… and here’s the ActionScript. You can remove the console.log lines if you wish, they were just initially helpful in knowing what was going on under the flash hood.

import flash.external.ExternalInterface;
//call from javascript
ExternalInterface.addCallback( "requestLSOValue", requestLSOValue );
ExternalInterface.addCallback( "setLSOValue", setLSOValue );

function requestLSOValue():void 
{	
	try
	{
		ExternalInterface.call('console.log', 'Trace: requestLSOValue');
		var obj_value:String = '0';
		var lso=SharedObject.getLocal("pd_check");
	
		// If name variable is not available, we assume that this is a new user
		if (lso.data.value!=null)
		{
		  obj_value = lso.data.value;
		}
		if (ExternalInterface.available) {
			ExternalInterface.call('console.log', 'Trace: getLSOValue::' + obj_value);
			ExternalInterface.call("updateLSOValue", obj_value );
		}
	}
	catch(e) {
		ExternalInterface.call('console.log', 'Flash error: '+e.toString());
	}
}

function setLSOValue( obj_value ):void 
{	
	try{
		ExternalInterface.call('console.log', 'Trace: setLSOValue');
		var writeSuccess:Boolean = false;
		// Create a shared-object named "userData"
		var lso=SharedObject.getLocal("pd_check"); 
		// Store the name
		lso.data.value=obj_value;
		var success = lso.flush();
		if (success == "pending") {
		 lso.onStatus = function(result) {
		  if (result.code == "SharedObject.Flush.Success") {
		   ExternalInterface.call('console.log', 'Trace: Sucess writing to disk');
		   writeSuccess = true;
		  } else {
		   ExternalInterface.call('console.log', 'Trace: Failure writing to disk');
		   writeSuccess = false;
		  }
		 };
		} else {
		 writeSuccess = success;
		}
	}
	catch(e) {
		ExternalInterface.call('console.log', 'Flash error: '+e.toString());
	}
}

The main thing I learned from this is, it is pretty useless as a replacement for third party cookies. This will not allow you to set cookies across domains… not that I could find anyway. So the flash movie file ( pd_check.swf ), that the flash player embed references, has to be on the same domain as the website ( where the JavaScript is trying to access the Flash ActionScript ).

Down the road, I am going to look into DOM Storage, mainly as a curiosity. I came across it in researching LSO’s and it looks very interesting. This facility is part of the HTML 5 spec so its not fully available yet, but it looks like a neat evolution of standard HTTP cookies.

UPDATE: I found a way to create cross domain or third party cookies here.