Amfphp And Https

[greenkube]

Has anyone had any experience setting up HTTPS and using AMFPHP with Flash? Even more specifically on a Windows server?

[greenkube]

Let me also add that amfphp is no more than a median to send binary data from Flash to a server, so would https even protect anything?

[CronoMan]

At 6/4/08 04:36 PM, greenkube wrote: Let me also add that amfphp is no more than a median to send binary data from Flash to a server, so would https even protect anything?

Well, it would encrypt the data :P

What problem do you have? Setting up SSL on IIS should be pretty straight forward... the hassle is obtaining a certificate, as they cost a shitload of money

[greenkube]

At 6/5/08 02:57 AM, CronoMan wrote: Well, it would encrypt the data :P

What problem do you have? Setting up SSL on IIS should be pretty straight forward... the hassle is obtaining a certificate, as they cost a shitload of money

Getting the SSL is no problem. I just didn't know if it was worth the hassle or if it is even applicable to this situation.

[greenkube]

At 6/5/08 08:39 AM, greenkube wrote: Getting the SSL is no problem. I just didn't know if it was worth the hassle or if it is even applicable to this situation.

sorry I meant certificate. I need caffeine.....

[CronoMan]

At 6/5/08 08:39 AM, greenkube wrote:

At 6/5/08 02:57 AM, CronoMan wrote: Well, it would encrypt the data :P

What problem do you have? Setting up SSL on IIS should be pretty straight forward... the hassle is obtaining a certificate, as they cost a shitload of money

Getting the SSL is no problem. I just didn't know if it was worth the hassle or if it is even applicable to this situation.

Well, SSL is primarily meant for privacy issues.. so unless you send some clear-text passwords over the internet, I don't think you really need one.. Is it a security-critical application?

[greenkube]

At 6/5/08 08:55 AM, CronoMan wrote: Well, SSL is primarily meant for privacy issues.. so unless you send some clear-text passwords over the internet, I don't think you really need one.. Is it a security-critical application?

Yes, the flash application authenticates from a database, so it currently passes a password in plain text to the amfphp gateway. I was just unsure if HTTPS would encapsulate this data being passed since it is going through a Flash amf channel instead of a typical web Post.

[CronoMan]

At 6/5/08 09:13 AM, greenkube wrote:

At 6/5/08 08:55 AM, CronoMan wrote: Well, SSL is primarily meant for privacy issues.. so unless you send some clear-text passwords over the internet, I don't think you really need one.. Is it a security-critical application?

Yes, the flash application authenticates from a database, so it currently passes a password in plain text to the amfphp gateway. I was just unsure if HTTPS would encapsulate this data being passed since it is going through a Flash amf channel instead of a typical web Post.

SSL is an underlying layer for HTTP (making int HTTPS), so if it's a HTTP-call, it will work. If it's fetching data from a website, or web service, it will work