Question

I am currently building a Flex 4 web app using PHP as my backend. I am using AMF to let the backend and flex application talk to each other.

How can I protect my AMF endpoint? Users can just decompile my flex application, find the URI to my endpoint and call methods. I need to ensure that all calls to the endpoint is done from within my application.

I would like to prevent somethig like this from happening: http://musicmachinery.com/2009/04/15/inside-the-precision-hack/

What are the best ways to achieve that?

Thanks 🙂

Answer 1

URLs aren’t important. They’re very easy to find out from any web application, and yet you still need it to have public access to them. There are a few things to do, first, if you’re interested in the data security itself, you’ll probably want to have your server running over https instead of http. If data security isn’t crucial however (and it often isn’t), you just need to have a quick and dirty authentication system.

I’m sure you can find many articles online or even frameworks made for authentication for php. In the past when I needed a very simple authentication, I would have my client send over a username and SHA1 password to an open authentication function on php, which would then create, store and return a session ID. That session ID would then be the first parameter of all the other php functions. Those functions would check the DB to see if the session ID is there or still valid (15 minute timestamp from the last time it was used) and if it is, go ahead with the function.

This is just a very simplistic way of doing things and will be good for a lot of small websites. If you need more security, send all of this over https to prevent sniffers to get the session id sent over the wire. After that, you’re going into enterprise security which is probably overkill for what you want to do and will cost you an arm, a leg and your left testicle 😛