0

Not sure this is possible but...

What I would like to do is to use ASP.NET impersonation to authenticate a Flash app as a user in IIS so that the file dependencies related to the flash file ( XML config files, and PHP API calls ) are not anonymously accessible when users try to access them directly through the URL. So, instead of displaying the contents of an XML config file, it should tell the unauthenticated user they do not have permission to view the file.

Is this possible? Right now I'm looking into request headers and the settings in IIS for authentication.

So I found out how to use Basic Authentication through help posted here. The problem I'm running into is that even though the flash app sends the appropriate request. Which is handled fine in FF, Chrome, and Safari. It still displays the login pop-up box for Opera and IE. Does anyone know why IE and Opera behave differently with Basic Authentication?

Any help on this would be greatly appreciated.

Paul Stoneking
  • 41
  • 6
  • From what I gather, it is possible but not ideal. I found a few resources to get you started http://stackoverflow.com/questions/509219/flex-3-how-to-support-http-authentication-urlrequest and http://code.google.com/p/as3httpclient/ – mikey Apr 02 '12 at 23:35

1 Answers1

0

use ASP.NET impersonation to authenticate a Flash app as a user in IIS

Assuming I understood your post correctly:

If your intent is to protect some file from unauthorized access, you should check if the solutions provided actually do so. Flash is a client side plug-in, and therefore its communication with the server (side) can be inspected using readily available tools (Safari/Chrome/IE developer tools, Firebug, etc). So if Flash is a "user" and you hard-code its authentication, it would be trivial to inspect that (http) request and "see" the data being passed....

On the other hand, if you are saying you want to incorporate a user login (each user will have to provide credentials) and then have that communicate with your server side authentication scheme then it would be fine (just like any other browser based login scheme).

EdSF
  • 10,269
  • 3
  • 40
  • 75