Russell Chun

A recent New York Times article by Tanzina Vega (a former student of mine at CUNY) reported about the growing concern over so-called “Flash cookies”, code from Adobe Flash sites that can store and track user data. At the heart of the matter is how Flash cookies are independent of the “normal” HTML cookies that you can purge with your browser, maintaining user control of privacy. You can also purge the information from Flash cookies, but the process is a bit convoluted and hidden. You can even control the amount of data, as well as prevent any data from being saved when you visit Flash sites. However, you must change the settings with every Flash movie you play, and not simply each site you visit. A single site may have multiple Flash movies playing, each with their own Flash cookies originating from a different source.

To see the options for a Flash movie, and to change the data that it can save, move your mouse cursor over the Flash movie and right-click (control-click for Macs) to access the contextual menu.

Choose the Settings option at the bottom of the menu. The Flash Player settings dialog box appears–click on the Local Storage tab, which looks like a folder with a green arrow pointing into it. The tab will indicate what site controls the Flash content and the origin of any Flash cookie that may be saved on your computer. You can move the slider bar to increase or decrease the amount of data that the particular Flash movie can save. The default amount of data that Flash can store is 100KB.

How do Flash cookies actually work? Flash ActionScript uses the class called SharedObject to save, store, and retrieve data from Flash movies. When you use a SharedObject, you can store a highscore from a game, a login or password to make it convenient for repeat visitors, or keep track of videos that have already been viewed. It’s important to know that a SharedObject is stored locally on a particular computer, so any data that is stored doesn’t follow you if you visit the same site on a different computer.

To keep track of information in a Flash movie, first instantiate a SharedObject and call the getLocal() method like so:

var mysharedobject:SharedObject = SharedObject.getLocal(“mycookie”);

The getLocal() method looks for a cookie called “mycookie” on the user’s computer, and retrieves any existing data. If the cookie doesn’t exist, Flash creates one. You can have multiple pieces of data stored within a single cookie–there is no need to create multiple SharedObject instances.

Now, simply assign information to a variable of the data property of your SharedObject instance, like so:

mysharedobject.data.firstname = “Russell”;

You can store any kind of data that Flash can handle. For example, you can retrieve and store the date and time that the user visited your Flash movie with the following code:

var mydate = new Date();
mysharedobject.data.thedate = mydate.getDate();
mysharedobject.data.thehour = mydate.getHours();
mysharedobject.data.theminute = mydate.getMinutes();
mysharedobject.data.thesecond = mydate.getSeconds();

To write the information in the cookie, now call the flush() method. When you quit the Flash movie (or leave the site), the flush() method is automatically called, saving the information, but the flush() method lets you choose when to save the information.

mysharedobject.flush();

When the user returns to your Flash movie, you can retrieve any of the stored data by using the getLocal() method and then reading the information in the data property of your SharedObject instance, like so:

var mysharedobject:SharedObject = SharedObject.getLocal(“mycookie”);
trace(mysharedobject.data.firstname);
trace(mysharedobject.data.thedate);
trace(mysharedobject.data.thehour);
trace(mysharedobject.data.theminute);
trace(mysharedobject.data.thesecond);

Test out how a SharedObject works by entering your name in the following Flash movie. Then close your browser window and return to this post. You’ll see how my Flash movie remembers and displays your name on your return visit in addition to the time that you last entered your name.