Flash and Facebook Platform mobile applications

Flash and Facebook mobile applications are like desktop applications; the application lives on the user's device after the user installs the application and login is handled solely by the Adobe ActionScript 3 SDK for Facebook Platform. On Android and Blackberry Tablet OS devices, the application is deployed as an AIR application (see Figure 5).

Figure 5. A Flash and Facebook Platform mobile AIR application on Android and Blackberry Tablet OS devices

1. The user installs and opens your mobile application. The application uses the Adobe ActionScript 3 SDK for Facebook Platform code to check and see if there is a current access token for this user and application. If there is not, it presents a Facebook login or authorization screen.
2. The ActionScript code in your SWF file makes asynchronous calls directly to Facebook using the Adobe ActionScript 3 SDK for Facebook Platform. The access token is automatically passed with each API call.
3. Facebook returns JSON-formatted data to your application and your application handles the data.
4. If you want to save any data on your server or do any other server-side processing, your ActionScript code can make calls to your server using typical remote procedure call methods (HTTP, web service, and Flash Remoting requests).
5. If the server needs to talk to Facebook for any reason, it does.
6. Your server handles results from Facebook.
7. Your server returns any data to the Flash Platform desktop application.

For deployment on iOS devices, the AIR application must be converted to a native iOS application using Flash Builder 4.5 or later or Flash Professional CS5 or later and then deployed (see Figure 6).

External Flash and Facebook Platform web applications

External Flash and Facebook Platform web applications (see Figure 3) are very similar to web applications on Facebook.com. The main difference is how you handle user login and application authorization. Instead of simply redirecting the browser to Facebook login and/or authorization pages, you use the Facebook JavaScript SDK in conjunction with the Adobe ActionScript 3 SDK for Facebook Platform to display the Facebook login and/or authorization pages in a pop-up window. Although the Facebook login is handled with JavaScript, you usually don't need to write any JavaScript code; you just call methods of classes in the Adobe ActionScript 3 SDK for Facebook Platform. Internally what happens is that code in the ActionScript SDK (specifically methods in the facebook.graph.core.FacebookJSBridge class) calls methods of the Facebook JavaScript SDK. The wrapper page for the application must include the Facebook JavaScript SDK.

Figure 3. An external Flash and Facebook Platform web application

1. The user requests your application on your website; the browser makes an HTTP request to your server. This request is for an HTML page or any application server page but will just be referred to as the HTML page from here on.
2. Your server returns an HTML/JS page embedding your SWF file. The wrapper page must include the Facebook JavaScript SDK whose methods are called by some of the methods in the Adobe ActionScript 3 SDK for Facebook Platform.
3. The users' browser makes a request to your server for the SWF file to embed in the HTML page.
4. Your server returns the SWF file. The application uses the Adobe ActionScript 3 SDK for Facebook Platform code (which calls methods of the Facebook JavaScript SDK) to check and see if there is a current access token for this user and application. If there is not, it presents the Facebook login and/or authorization web page in a pop-up browser window.
5. As the user interacts with the application, it makes asynchronous calls to Facebook using the Adobe ActionScript 3 SDK for Facebook Platform. Every API call must include the access token (this is handled automatically by the SDK) and the Facebook server must have a crossdomain policy file giving SWF files from your server access (which it does).
6. Facebook returns JSON formatted data to your application and your application handles the data.
7. If you want to save any data on your server or do any other server-side processing, your ActionScript code can make calls to your server using typical remote procedure call methods (HTTP, web service, and Flash Remoting requests).
8. If the server needs to talk to Facebook for any reason, it does.
9. Your server-side code handles results from Facebook.
10. Your server returns any data to your Flash Platform application in the user's browser. 

Flash Platform applications on Facebook

Figure 2. A Flash Platform application on Facebook.com

1. The user requests your application while on the Facebook website; the browser makes an HTTP request to the Facebook server.
2. The Facebook server returns an HTML/JS page containing the Facebook website chrome and an iFrame HTML tag.
3. The user's browser makes a request to your server for the page to display inside the iFrame. As before, this is either an HTML page or an application server page but now this page also embeds a SWF file, the Flash Platform application.
4. Your server returns an HTML/JS page to the user's browser, which is displayed in the iFrame. This page must still contain logic checking to see if the user is logged in to Facebook, but now this check can be done in the embedded SWF using the Adobe ActionScript 3 SDK for Facebook Platform. The application contains code to check for the existence of an access token. If there is no access token, you must add code to redirect the user to the Facebook login page as before.
5. The users' browser makes another request to your server, this time for the SWF to embed in the HTML page in the iFrame.
6. Your server returns the SWF file.
7. As the user interacts with the application, it makes asynchronous calls to Facebook using the Adobe ActionScript 3 SDK for Facebook Platform. Every API call must include the access token; this is handled automatically by the SDK.

Due to security restrictions of Flash Player, SWF files can only make data calls to the server from which the SWF file was served (that is, your server) or to servers that have a crossdomain policy file listing the server that the SWF file came from. This means that for your SWF file to make calls directly to the Facebook server, the Facebook server must have a crossdomain policy file giving SWF files from your server access. If you take a look at the Facebook cross-domain policy file, you will see a wildcard entry granting access to SWF files from all servers.

8. Facebook returns JSON data to the application.
9. As the user interacts with the application, it can also make asynchronous calls to your server (to save any data on your server or do any other server-side processing) using typical remote procedure call methods. For Flash Platform applications built with Flex, this includes HTTP, web service, and Flash Remoting requests. The quickest and smallest calls result from using Flash Remoting, which uses the open-source binary protocol Action Message Format (AMF) to exchange data between the server and Flash Player.
10. If the server needs to talk to Facebook for any reason, it does.
11. Your server-side code handles results from Facebook.
12. Your server returns any data to your Flash Platform application in the user's browser.