R – Flex Channel Security Error while logging into two different domains from single app

By default Flex does not allow accessing web services on remote hosts. This is a security feature of Flex. Since your Flex app is deployed at myapp.mysite.com it's under different host than the service at mysite.com.

You can add a crossdomain.xml to the mysite.com which Flex will check to see if the service allows access from different domains. The crossdomain.xml file must be located in the web root of the domain (mysite.com/crossdomain.xml). I've used the following contents to allow debugging use. Note that it allows all use so if you want to restrict the use in production, you need to modify it later.

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM
    "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="*" to-ports="*" />
   <allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy>

More information in Flex documentation, especially the knowledge base article.

If your Flex app is on the server with ip 5.6.7.8 you need to allow that ip in the crossdomain for the 1.2.3.4 server. This let's the Flash running from 5.6.7.8 know that 1.2.3.4 allows connections from that specific adress.

If you still have the same problem a quick way to find out what's going on is to use a debug proxy (i like Charles). That way you'll see flash' request for the crossdomain.xml and what the response looks like, most likely the request is going somewhere you didn't expect or the server messes it up somehow.