ActionScript 2.0 :: Secure Login SWF - Creating Session For Valid User
Jul 20, 2005
I am trying to write a secure login using flash. I worked out that the login must be separate from the protected content otherwise a decompiler will get round it very quickly. At the moment I have a login swf that posts variables to a server side script which then creates a session for a valid user.
The idea is to then forward on to the protected content. However I am unsure how to pass the users info to the swf so a user could not modify before the swf gets it and thus see another members content or what I can do to stop someone just accessing the content directly by just knowing the swf file's location.
View 2 Replies
Similar Posts:
Mar 26, 2012
I would like to create a secure login section for a website. I have managed to build up an AS3-PHP communication where PHP checks user credentials. I am already providing data enchryption between AS3 and PHP but I would like to add some further security. Is it possible to implement a HTTPS login section?
View 5 Replies
Jun 3, 2010
I have a webpage where user enters details. These details are sent to php and session variables are created. My new swf then grabs these variables and displays them in a movie. Now the whole idea is for this movie clip with the details then to be sent to someone as a link. But, if the receiver then opens this link, they wont have the session variables though, and the details will not display.
View 1 Replies
Apr 27, 2010
I'm creating a flash application that will post images to a url for saving to disk/display later. I was wondering what are some suggested strategies for making this secure enough so that the upload is verified as coming from the application and not just some random form post. Is it reliable enough to check referring location realizing that I don't need bulletproof security, or perhaps setting authentication headers is a better strategy even though it seems unreliable from what I have read. The application and the server script will reside on the same domain and is in java - is there a way to check for a 'session' or something like that?
Another thought I had was some sort of simple hashed key type system, I could hard-code a key into the flash application and pass something to the server based on that - the server would also know this key and be able to verify if the value passed was based on that? The app is a public app, so authenticating users is not an option. After more research I am thinking about using a hard coded salt key on both ends, then sending an MD5 hash of the base64 encoded image bytearray+salt to be matched on the server side.
View 1 Replies
Dec 3, 2011
I have an AIR app in AS3 that connects to an online database, checks the login details for the user account, and logs in if all is good. Once logged in, the user can update database info, plus overwrite files in their user directory. So far it's working fine.
Problem is, I've only got it set up to send the raw login data. Once the php receieves it, it's hashed to check the hashed version in the database, but is there a way to hash and then unhash a password sent from an AIR app? Or a way to use https?
Also, regarding sessions, if you have a seesion in a browser, the session closes automatically when the browser closes, right? So how do you make a session close that you've opened via an Air app? I guess you could trigger a close from certain actions within the app, + when the app closes, but say the app crashes, or the computer crashes - will your session still be floating around out there open?
View 3 Replies
Dec 13, 2011
I was wondering what the best route to take for making a login. The idea is to have the user login with their username and pass on frame 1. If the username and pass exist in the MySQL database then the user will be moved to frame 2. What would be the best way of achieving this? I know AMFPHP is old and I have heard to use ZENDAMF instead, but it seems that any recommendations are 2+ years old when I searched Google.
View 1 Replies
Mar 17, 2006
I have a html pages in which user is logged onin one page he can use swf movies but that movies need to know which user it isso I need to pass vars to swf (username), but that can be problembecause anyone could open swf with submitting username to swfso I need somehow secure user var pass to swf at startif
View 4 Replies
Jun 30, 2011
i recently had a look to the tutorial for custom authentication within a flex application. The login is managed by getting the ChannelSet from a RemoteObject:
private function creationCompleteHandler():void {
if (cs == null)
cs = ServerConfig.getChannelSet(remoteObject.destination);
[Code]....
After that the channlset can be used with the login command of ChannelSet. How can i insure that this is using a secure connection? I know that there is a amf channel and a secure amf channel. But how to tell to provide the credentials in a secure connection?
View 1 Replies
Jan 7, 2010
I have a Flex login page that uses HTTPService to communicate with server side php script. Once user's credential is verified, a session will be created and the login page will redirect to the main Flex page with that session info. I'm not sure how to implement the session logic.
View 2 Replies
Feb 28, 2012
I'm trying to build a secure login area on a Flash-AS3 website. I've managed to create the login form and pass data to a PHP script which checks them.
1) I know that in PHP I can echo some infos that can be get from AS3. In this case I suppose to echo something like "success" or "failed" to give an answer to the login attempt. Is this way of communication secure? Can anybody sniff this content and force AS3 to behave like if login was successful?
2) Suppose that PHP-AS3 communication has been secured. What should I do now? May I simply show admin pages hidden before? Is it the correct way? Is it secure?
View 5 Replies
Jan 21, 2012
I'm trying to build a secure login area on a Flash-AS3 website. I've managed to create the login form and pass data to a PHP script which checks them. Now I've got some questions.
1) I know that in PHP I can echo some infos that can be get from AS3. In this case I suppose to echo something like "success" or "failed" to give an answer to the login attempt. Is this way of communication secure? Can anybody sniff this content and force AS3 to behave like if login was successful?
2) Suppose that PHP-AS3 communication has been secured. What should I do now? May I simply show admin pages hidden before? Is it the correct way? Is it secure?
View 5 Replies
Aug 27, 2010
I have a highscore system in that I have small doubt like I want to store the user session in the mysql table and also the guest session. Like if the user is registered user then that session should be stored in the mysql db. Else if the user is not registered i.e guest user then also I need to store with the guest account for my high score system for a flash games site.
View 1 Replies
Jun 4, 2010
I have a java web application. When I log in to that application and navigate to a jsp which has flex chart embeded into it, the chart displayes just fine. I am using blaze ds remoting object mechanism. But when I want to navigate to a different page, it logs me out of application since the login session is lost.
View 1 Replies
Jul 21, 2010
In my Flex application, channelSet is reset on each browser refresh.If you've authenticated and refresh the page and check channelSet. authenticated, it says false, but your remoteObject calls will still work because the server session still exists.I have a service call that checks for a session on the server and can identify that one exists when a user has already authenticated and not logged out, but how can I bypass login and still set the channelSet.authenticated to true without calling channelSet.login() when they come back to the page(before a timeout occurs, of course)?The user session isn't closed if you exit the browser. Currently it does in fact make you log in again. But there is an existing session so blazeds returns a re-authentication error if you're not the user in the session, and it also allows you to login with any password if you are the user because it sees that the session has already been authenticated.So how can I make it so the session is invalidated upon closing the browser or refreshing? I could do it by automatically logging out when the app starts, but that doesn't seem very elegant.[code]
View 1 Replies
Aug 4, 2010
I want to manage a username session for lifetime. means for example if u look a website [URL] in this website i have registered and i haven't logged out but whenever i open up this website my username appears there. No need to login again. so i want to do the same for my one of the games website. i have developed my website using php mysql flash.
View 3 Replies
Nov 13, 2010
i have a php page,inside i include a myflash program.in myflash program i have a function to add to cart when user want to buy something..but i want if they want to click the add to cart button the user first must login to the php page.login module i put in same page with flash program..how can i make if user press the add to cart button,if he not yet login the warning box will appear tell he must login first.i can make it with javascript in php page.. but in flash i donk know how.
View 7 Replies
Jan 17, 2011
I've a flash facebook application, i can take the session info from flash client and send the session information to server.
I need to check if the user connected to the server via facebook application or not. That's why i need to get the user's session from facebook page directly by my server.
How can i do it? I use C# for all database and communication system. Flash interface does only application responsibilities.
View 1 Replies
Apr 17, 2009
Question - I can't seem to find this anywhere... is it possible to get the user's login name with as3? I'm referring to the name they log into the OS with... this is possible in just about every other language.
View 4 Replies
Apr 7, 2012
We are planning a desktop client application with Adobe AIR. The client app will be delivered to our customers with a database, which contains monthly updated marketing data provided by our company. As different customers will buy different sets of data from us, for example, a customer is only interested in marketing data in a specific product category, while another customer need all data in a certain region. After a customer installs this client app, new data will be emailed to the customer every month.
So, the requirement is to keep the data accessible only by the customer who bought it. After reading through AIR's secure local store and database encryption feature, I came up with the following design: each customer will have his own secret key (stored in AIR's secure local store), the secret key is used to encrypt the data that the customer has purchased. Of course, the monthly data that we sent to the customer will be encrypted using the same secret key. So my questions are: is AIR's database encryption and secure local store secure enough for this use case? If someone gets the encrypted database file, can he decrypt the DB?
View 1 Replies
Jul 27, 2010
What's the best way to save user credentials in flex? Local storage doesn't seem like good place for storing confidential data, because it saves information as a plain text.
View 5 Replies
Jan 9, 2011
I am trying to make a login that allows the user to create an account and be able to access it at anytime. Like if I was going to go on to facebook I can login. Something like that except I want it in my swift and not like a php or whatever you call it now.
View 9 Replies
Nov 7, 2011
All I want is to have the latest 3 or so posts from my clients Facebook page to populate and animate in a screensaver that I am building using Flash (AS3).
So far, every time I try to bring anything in, it requires a complete oAuth login and account link, but it's only a one way exchange (read-only, absolutely no writing, posting or even linking, since it's a screensaver) I'm not even sure the client wants pictures or anything.
I am currently trying to use the facebook-actionscript-api, but there isn't an option for the "App Login" type of Authentication that would solve most of my problems.
View 1 Replies
Jun 14, 2011
Is there a Who Am I command that can read the Windows user name in flash? I'm working on a local internal app that needs to log who is logged in when making changes to the data. I don't want a prompt for who is logged in, I would like the app to check with windows. Is this possible?
View 1 Replies
Apr 11, 2003
I have tried to make a login sequence where a user gets three attempts, tries. And then is given a non authorization message.
View 7 Replies
Jun 14, 2010
I'm trying to create a simple login for a flash site written in AS2. This should be extremely simple. I don't want to use PHP and MySQL, that would be overkill. On the home page of the site, I want a login box to appear, then once the correct user name and password is entered, I want to gotoAndPlay(whatever) I have three text boxes setup with following instance names assigned:
[Code]...
View 2 Replies
May 31, 2011
how I could create a login script that would save all users, passwords, and theyre data(scores, play time, etc) to an XML file. I am very new to XML and cant seem to find anything about this on the internet. I plan on saving this XML file on my website and having the swf load it from the website.
View 2 Replies
Oct 21, 2009
I have a problem with these functions when I register the first user it works just fine but when I register the second the first user is deleted. I'm saving my data inside the swf because I couldn't write the functions in SQL>
This is my register function
ActionScript Code:
function registerplayer(e:MouseEvent){
savedata.rpname = rpn.text;
var registername = [savedata.rpname+"N"];
savedata.registername = "name";
trace(registername);
[Code] .....
View 0 Replies
Jun 16, 2004
I know it exists, but I just can't figure it out. from the site I created, [URL] the login is obviously input text. How can I have the text disappear when the user clicks into the login field?
View 3 Replies
Jun 16, 2004
I know it exists, but I just can't figure it out.from the site I created,[URL]the login is obviously input text.How can I have the text disappear when the user clicks into the login field?
View 3 Replies
Sep 10, 2009
I am trying to create a simple login page, once the user has logged in successfully they will be taken to another site which contains their photos. I have created the login page already, it has a Username and password plus the Submit button. I guess 2 things need to happen here:
1. I would like to be able to access an xml document which contains the Username and Password in order to validate the details.
2. Upon successful validation, the user is directed to another page which contains their gallery, I guess I need to add a navigateToURL here in actionscript where the URL is passed from the XML file to the code (the URL needs to come from an the same XML file, if possible).
I am trying to design this site so I don't need to keep accessing the actionscript in flash to add user details and URL links.
View 3 Replies
