0

I have a flash file that is located on my website and I have a PHP file which gets requests from flash file every 5 minutes. I want to be sure that flash file which is sending request is located on my website and not somewhere else. How can I do it. Is there anything in PHP's global variables that can help me or there is something else I can do?

1
  • Checking this from flash is no different than checking the same thing in an AJAX handler: Check referers (unreliable), use tokens (more reliable, but still not fool proof), require a validated login (better still), etc...
    – Marc B
    Apr 5, 2012 at 19:04

2 Answers 2

0
var url:String=stage.loaderInfo.url;
var goodPattern:RegExp=/^(http:\/\/)(www\.)?stackoverflow\.com/;
if (goodPattern.test(url)==true) {
    trace("This flash is hosted on stackoverflow");
} else {
    trace("This flash is hosted not on stackoverflow");
}
2
  • Thanks but It is not reliable solution because it is on user side. I need to check it in php not in flash. Apr 5, 2012 at 19:02
  • You can add data from stage.loaderInfo.url into your requests coming from flash, like a signature, or a hash of this, then compare it with PHP.
    – Arkady
    Apr 5, 2012 at 19:42
0

You might get something from $_SERVER['HTTP_REFERER'] or $_SERVER['REMOTE_HOST'] but this information can be spoofed.

There are many methods that can be used to ensure requests are coming from a particular/legitimate source. The technique that initially comes to my mind for sender verification is using a digital signature. If you want to avoid using a public-private key pair, and since the request is coming from the same server that is receiving, then using a pre-shared secret key might be appropriate (just be sure to hash with a salt).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.