Skip to main content
Anonymous
December 8, 2006
Question

Security and authentication

  • December 8, 2006
  • 2 replies
  • 401 views
The bottom line is I don't know anything about either of these two areas. I've always been a client side interactive developer and designer, handing off the real backend work to developers in that field. FMS is finally plunging me into this area, as now I can apply my knowledge of ActionScript to the server side of things, and pull together some amazing stuff.

How should I authenticate, say, a basic chat, so only logged in users can send a message? I can easily require login on the clientside, but that wouldn't stop spoofing and decompiling. Is the FMS communication encrypted? I could send username/password for each message based on the client input, and authenticat securly on the server against a serverside list, but that seems rather foolish in the event someone listens in on the clients messages, they would then see the username and password. But how else would it be done?
    This topic is closed to new replies. Start a new post to keep the conversation going.

    2 replies

    Anonymous
    December 9, 2006
    Thanks Jay. So basically it's done the same same old way(as best I understand), only since its FMS instead of multiple page views you only have to pass in the token/sessionID at FMS connection. So in other words, if you manage to connect, there's really no need to continue to authenticate every action requested by the client. Is that correct?

    That being said, I don't know a thing about http authentication and databases, but I have the human resources to do that for me.

    Also found this thread, which looks to be the same route thoroughly played out:
    http://groups.google.com/group/macromedia.flash.flashcom/browse_thread/thread/d2b5eb519f2b5a75/f26144fb6694a683?lnk=gst&q=authentication&rnum=3#f26144fb6694a683

    Thanks!
    Anonymous
    December 8, 2006
    FMS can use SSL just like an https server can, but it's not configured by default. You'd need to set up a certificate and configure FMS to use SSL. That said, unless you need to encrypt the chat (or other data/audio/video), you don't need to secure your FMS

    Really, all you need to to is authenticate once when the user connects. Here's what I like to do:

    1. Have the user log in via https (before connecting to the FMS app)
    2. Have the http side login process create a token (I like to use a random 50 character string) and store it in a database
    3. Pass the token back to the client in the response to the authentication request
    4. Connect to FMS, passing the token in the netconnection.connect arguments
    5. Before accepting the client, the FMS app calls back to the http server (using loadvars, netservices, or an xml object), sending the token in the request
    6 The http service checks the ticket, and returns a success or failure message. If the ticket is good, the service expires or deletes it so it can't be used again.
    7. The FMS app accepts/rejects the client based on the response from the token authentication request.

    So, the only time a password gets transmitted is when the client first logs in. That makes it easy to encrypt the sensitive data, and then just send the token (unencrypted) to the FMS server. Even if someone intercepts the token, it will be of no use to them, as it can only be used once.
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices