Most of below limitations are Adobe Flash API restrictions. We assume that in future versions of Adobe Flash Player they will not be presented.

Bugs and Limitations

Because of security restriction, in the Flash Player 10 open "browse dialog" via JavaScript is not possible without user interaction with flash object.
Workaround: the EAFlashUpload has overlay mode: flash object is placed over HTML object specified by overlayModePlaceholder property and handles mouse click events.

Flash Player does not offer complete support for servers that require authentication. There is no a workaround of this limitation.
Suggestion: Upload files to location that doesn’t require authentication. Windows Authentication works properly for asynchronous request only that can be achieved through JavaScript API. So, you can check whether current user is authenticated or not by sending test asynchronous request to authentication page.

The Flash Player of Non-IE (FireFox, Safari etc.) browsers don’t send browser cookies with upload request. Therefore, server-side applications that use cookies (ex: authentication, session tracking (state maintenance)) doesn’t work properly.
Suggestion: the EAFlashUpload retrieve browser cookies and send it as a value of form field. For example: session can be restored on the server-side by retrieving this value. Distribution package contains example of session restoring for PHP and ASP.NET. See also retrieveBrowserCookie.

For some unknowing reason Flash Player not always works properly with "https" protocol prefix in URL of file processing script. So for upload via SSL URL should be converted as follows: http://www.site.com:443/uploadfiles.aspx. Port 443 is a default SSL port.

The Flash Player may not properly use proxies. It does not handle authenticating proxies well (if at all) and will some-times crash. There is no a workaround.



Architectural singularities

When multiple files are being uploaded each file is uploaded in separate request. Files is sent in compliance with RFC 1867 (Form-based File Upload).

Uploading operation can access files only within its own domain and within any domains that a cross-domain policy file specifies. So you have to put a policy file on the file server if the page initiating the uploading doesn't come from the same domain as the file server. See more about cross domain security here Web site controls (policy file).

The Flash Player uploads all files with a mime type of application/octet-stream regardless of the file actual mime type.
Suggestion: Determine mime type on server-side based on file extension.

Server-side script that is processed uploaded file should send at least one character to the response, otherwise file load end event doesn’t occur and upload stops. Very long server response will be truncated.

The Flash API doesn’t allow setting the default file location for the dialog box. The default location shown in the dialog box is the most recently browsed folder, if that location can be determined, or the desktop. The Flash API doesn’t allow the SWF file that initiated the upload to access the uploaded file or the file location on the user's disk.

There is no way to get path of selected file on the user machine. Only file name is available for retrieving.