Skip to main content
S
Sauleve
Participating Frequently
February 1, 2009
Question

Passing flash variables to CF

  • February 1, 2009
  • 1 reply
  • 1228 views
All the ways I've found so far of passing variables back to CF from flash seem to involve either getURL with POST/GET or the loadvars method. This seems to inevitably require a page refresh which I would like to avoid if possible.

The other issue is that the variables are presented to CF as form variables which leaves the CF page vulnerable to cross site attack. Ideally I want the swf embedded on my page to be the only way of passing data through to my CF handling page.

Is this possible?
This topic has been closed for replies.

1 reply

N
Newsgroup_User
Inspiring
February 2, 2009
Paul Galloway wrote:
>
> Is this possible?
>

NO!, unless you want your SWF to *only* be accessed by a user sitting in
front of the server. Saying 'form variables which leaves the CF page
vulnerable to cross site attack' is the same as saying, 'making a web
site leaves me open to web site attacks.' Basically a true statement,
but following best practices of coding web applications can mitigate.

Having said all that, I think you may want to be looking at Flex and
ColdFusion. Flex uses the Flash client to work with server back ends.
This allows one to use AMF channels to pass data between the server and
the client. While this will not prevent cross site attacks, one still
needs to be intelligent in how one builds ones sever side code. It does
give one more direct client and server communications without client
refreshes and the server can push data to the client.
S
SauleveAuthor
Participating Frequently
February 3, 2009
Well the issue I'm trying to mitigate is that the user downloads my swf, decompiles it, looks at my actionscript which shows

on (press) {
dataOut = new LoadVars();
dataOut.credits = credits;
//Using send ( ); method to send the data
dataOut.send(" http://mysite.com/cashout.cfm", "_self", "POST");
}

and simply creates a form to submit form.credits field to my form handling page. If they are a registered user correctly logged in using session variables this goes through just fine. Is there a way of knowing that the variables are being passed from an instance of the swf on my domain?
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices