ActionScript 3.0 :: SWF Hosted On HTTPS Not So Secure After All?
Sep 17, 2010
I have a SWF hosted on a https enabled domain and amfphp installation on the same domain. Now when i let user embed the swf on his on http page, i intend to send some data to amfphp without user seeing it. However i see that firefox with firebug plugin catches the post data easily. How is this happening ? Adobe documents say that if a swf is hosted in https and destination is also under https, its suppose to be secure?
I need to transfer data from a flash application running in a browser to a server running php. If I use an https connection will that be enough to ensure that the data sent from flash to the server is encrypted and sensitive data can't be sniffed, or do I need to do encryption in my flash application itself?
am having this problem of sending XML request to an addresswhich starts with "https". The problem is I always get the errormessage "Error opening URL "https:......."", instead of the actualresponse which should be in XML format as well.The function I am using is "sendAndLoad()"requestXML and responseXML are objects of XML class . Whatfunction "sendAndLoad" above does is to post variables in the"requestXML" object to the specified URL "servelet_address". Theserver response is downloaded, parsed as variable data, and theresulting variables are placed in the responseXML object.However, as I stated above, I always get the error message.
I would like to create a secure login section for a website. I have managed to build up an AS3-PHP communication where PHP checks user credentials. I am already providing data enchryption between AS3 and PHP but I would like to add some further security. Is it possible to implement a HTTPS login section?
I am having a problem with sendAndLoad on a secure site. Has anyone run across this before? In Internet Explorer it does not work at all. The Flash forms are sending data to PHP scripts on the secure site (https) and connecting to a MySQL database. If I change it to a non-secure site (http) it works fine.
Using Php file i m able to save all data but didnt get response back to flash file using [ result="OK" ] OR also i have tried replyXML.onLoad = function(success:Boolean) { but always it become fail.
We are planning a desktop client application with Adobe AIR. The client app will be delivered to our customers with a database, which contains monthly updated marketing data provided by our company. As different customers will buy different sets of data from us, for example, a customer is only interested in marketing data in a specific product category, while another customer need all data in a certain region. After a customer installs this client app, new data will be emailed to the customer every month.
So, the requirement is to keep the data accessible only by the customer who bought it. After reading through AIR's secure local store and database encryption feature, I came up with the following design: each customer will have his own secret key (stored in AIR's secure local store), the secret key is used to encrypt the data that the customer has purchased. Of course, the monthly data that we sent to the customer will be encrypted using the same secret key. So my questions are: is AIR's database encryption and secure local store secure enough for this use case? If someone gets the encrypted database file, can he decrypt the DB?
Is there any way via Actionscript that I can have a swf determine what URL it's hosted under? For instance, if I put my swf on this site, I want it to behave one way and on another behave completely differently. Make sense?
This code is posted in several places saying it works with paypal. For some reason, for me, it does not work - I get to paypal's homepage instead. However, the same code (sort of) works if I just use a straight html page. I don't get it.S3
Code: addcart.addEventListener(MouseEvent.CLICK, addItem); function addItem (event:MouseEvent):void
I created a swf embedded on a web document and hosted on our local server. I have no problem previewing and playing it on flash player 10 but whenever I attempted to play the same swf in flash player 9 I'm getting a popup security warning. I went ahead and registered it on the Adobe website but still with no success.
I'm looking for an AS3 function to get the filesize of a file that is being hosted on a remote webserver. Tried to find some functions but didn't succeed.
I am looking for an online photo editor like url...) or picnik.com/info/api (Flash) but I need one that I can host on my own server.. been searching for a while but no results..I also love the idea behind url... but its so expensive.
Here is the external swf loader that is commonly used and which I used
ActionScript Code: var xpos:Number = 4; var ypos:Number = 4; var swf:MovieClip; var loader:Loader = new Loader(); var presvid:URLRequest = new URLRequest("presentation/presentation.swf"); loader.load(presvid); loader.x = xpos; loader.y = ypos; addChild(loader);
The presentation.swf file plays well when I test the movie, but when I upload it to the internet to say swfcabin.com or deviantart, etc or any site which supports swf, the presentation.swf file doesnt play.
I have an external preloader that loads the game that's hosted on And let's also say that game is amazingly ridiculously popular that it exceeded the monthly bandwidth limit of my free hosting plan on that server and my account gets suspended. Then what will happen when the Loader object calls load (new URLRequesI'm planning to upload a game to a distribution website and they strongly encourage that the games be contained in one single swf. But trying to do a internal preloader is shortening my lifespan.So I plan to maybe have the game swf hosted on multiple servers and if the primary server fails due to heavy traffic or the account got suspended then the player can choose to load from a different server. I'm pretty sure that's possible..
I've embedded a virtual tour on one of my client sites.
The site is hosted by Slicehost, and as you can see the load times for the Flash movies are very slow, so my idea was to serve the swf files from Amazon S3 Europe.
To test it, I have all swfs uploaded to the same directory / bucket on Amazon, while the index.html and p2q_embed_object.js files reside on my local machine. The js file is changed to refer to the Amazon-hosted swfs. The first swf loads fine, but the others don't. What am I doing wrong? Is there a better way to do this that would allow me to serve my Flash assets from elsewhere?
i have a php page hosted on 1 domain and a flash login page on another and im trying to get the SWF on one domain to retrieve data from the php page on the other domain.If i run the SWF file on the same domain as the login script it works fine, The swf retrieves the info from PHP The current AS code is here.[code]
I am able to publish flash as long as I launch from local computer. Can't get flash to play when I publish on external server hosted by ISP. Is there another method to publish that does NOT require the Ac_RunActiveContent.js?
I used AS3 to successfully load a web-hosted video file when I tested my app. within Flash CS5. However, I published as a Windows projector EXE file and the web-hosted video won't load from within Flash Player 10 running the EXE.
I am looking for the abilities that Youtube's Chromeless player has to offer but for non-Youtube hosted videos such as Metacafe, Vimeo, Viddler, etc. Abilities I will need are :
[Code]....
Can I use Chromeless player for videos hosted on other sites besides Youtube? If not, is there a solution out there? If not, what languages/APIs would I need use and know to create such an application?
We are writing a new social app that connects to FB using FB connect (actually, it's in Flash so we're using the FB AS3 SDK, which uses the FB Javascript API under the hood AFAIK).
When the flash app is served from our site - it works fine.But when we try to embed it in a 3rd party site (using an Iframe that points to our site) the following happens: when we try to perform a login to FB using the AS3 function Facebook.login(onLogin, opts), a small browser-based login to FB pop-up comes up, but it has the following error first
Or is it possible that FB don't support FB connect apps that are embedded in 3rd party sites?
I want to create a custom video player to modify the skin of the play controls etc but still host the videos on youtube.The youtube api allows for minor colour adjustments but not full customisation. I know it would be possible if I download the FLVs but i want the video to remain hosted on youtube.
I have to make connection to the DB and Insert a row based on the data that the SWF sent me...I will need to make it so that the SWF->PHP part is secure by not letting users tamper with data.I don't want to use SSL because its not a suitable solution... what other method is available?
I have an SWF that communicates with a PHP file and ultimately the DB. The PHP checks whether the User has the appropriate Password etc. and if it is accepted, the actions the person performed on the SWF (game) are used to compete with other Players of the game.
send altered data or actions that are illegal in the game with their submition? To clarify: If a character in the game can only move 1 square at a time, can an evil evil hacker/decompiler (who is a Player in the game) tell the SWF to tell the PHP file that his/her character moves 3 squares at a time?
I'm just want a sense that things will be somewhat secure. There isn't any sensitive information in the SWF besides the location of the PHP file on the net.
I have a Flash movie written in Flash 8 with AS2 that is attempting to access a webservice on a server that is https.
I can't get the webserviceconnector to even load the WSDL file.
I have a crossdomain.xml file at the root of my http/https server that allows the domain the swf is being served from to get in and it has the secure attribute for that domain set to false, but it still can't get through.
Not sure what I am missing at this point.
I have a quick update. I figured that since my webserver is serving the secure site up under a different Website in IIS that I needed a crossdomain policy file at the home directory of the site. I have placed it there and when the movie loads I am using loadPolicyFile to get the crossdomain file which still loads into flash without issue but I still get a WebServiceFault when I try to load up the WSDL.
Can anyone point out a crossdomain example where a flash movie on an http domain is accessing a webservice on an https domain?
I export a swf/html direct from flash, very simple. I upload it and it works fine in all browsers. If I change http to https in all browsers, no problems.
All browsers except IE - when I change http to https, I just get nothing - if I right click I get "Movie not loaded..." (greyed out) and the usual about flash player.
I've reinstalled my flash player, read loads of tips and tried loads of other hacks but nothing seems to work.
Everything runs fine in Firefox, but when the SWF tries to make a request in IE, I get an IOError. I've read that it might have something to do with no-cache settings and that a possible solution is to use URLRequestHeaders.
We have a swf file that we want to secure and make available only to authorized users.
I embedded the file in an aspx page and that works fine, since ASP.NET handles the aspx page, I can use ASP.NET authorization features and in the web.config restrict the access to roles="AllowedUsers" for example.
However smart users could still get to the file by accessing directly for example www.mysite/flash.swf. We want to make that kind of access secure.
I have a flex application, running with amfphp and connected to wamp, I want to use a secure connection using ssl, but my whole application is running from the same swf file, would using ssl in that case mean that all the data, being sent and received between the server and client ,encrypted? Because this is not what I'm trying to do, I only want to encrypt the sign up and sign in data.
please note that, I have log-in bar which is visible the whole time as long as the user is not signed in.in other words, I only want to secure some of the data being transferred not every thing.
