Secure your Flash-PHP connection
Posted in: Programming,Security,Web design
If you’re working on a Flash game in which you are saving player score in a database, you might wanna consider applying some security to it :)
As I know, you cannot access MySQL database directly from Flash, so you’ll need to do some ActionScripting and call an external script to do it for you. For this example, we’ll be using PHP as a server-side script that will be doing MySQL communication.
I’m not Flash expert but I’ll paste here a sample ActionScript that calls an external URL for data processing:
-
-
var my_lv:LoadVars = new LoadVars();
-
my_lv.onLoad = function(success:Boolean) {
-
if (success) {
-
trace(this.toString());
-
} else {
-
trace("Error loading/parsing LoadVars.");
-
}
-
};
-
my_lv.load("http://www.example.com/flash_db.php");
-
Now, let’s talk about that security. The easies way to implement security is using HTTP Authentification (Basic or Digest). In this example we’ll be doing a Basic configuration.
At the Flash part, you’ll have to upgrade you ActionScript part with the following lines:
-
-
var str = Base64.Encode("my_username:my_password");
-
my_lv.addRequestHeader("Authorization:", "Basic "+str);
-
my_lv.load("http://www.example.com/flash_db.php");
-
For the above example you’ll need actionscript Base64 encoder class.
The PHP code that you’re calling is processing this secure communication with the following code:
You can simply copy/paste the code from above at the very beggining of your PHP script and that should do the trick. Of course, you can do some extra user validations, to check user with the password in the database, and then to see this specific user credentials, etc.
You can read more on HTTP Authentification with PHP here:
http://www.php.net/manual/en/features.http-auth.php
If you’re asking yourself why should you just send user/pass variable via POST method, read one of my previous posts – web debugging.
On Brian Meidell’s blog you can read more on this topic as well as some usefull comments.
There are some issues with some web browsers while trying to accomplish this type of authentication…
I must say once more – I’m not a Flash expert and as far as I know this should work :) but also, this type of security should work with any other technology that is capable of doing HTTP Authentication.
Return to: Secure your Flash-PHP connection
Social Web