Cakephp Session lost in Flash player

Question

Just want to know if anyone have the same problem.

The website need to login to perform certain task. We use stock Auth component to do the job.

Everything is fine until it hits an interface which build in Flash. Talking to Amf seems fine. But when the Flash player try to talk to other controller - got redirect because the session in not presented.

So basically when a user login - I need to somehow find a way to login the Flash player in as well.

Answer 1

in config/core.php try

Configure::write('Session.checkAgent', false);

Answer 2

This only solve half of the problem.

Backtrack a little bit. How the Auth components evaluate the requester?

If the Session.checkAgent is true. They check if its the last one. So Flash has no chance they have a different Agent string.

OK now - Auth check them out - what? The Session cookie they store earlier ... so fail again.

#

UPDATE

#

Thanks for all the answers.

I have tried the suggested solution. Only one problem.

I am using Amf (as Cakephp Plugins) when I tried to test if the $this->params['actions'] is start with amf - it works sometime doesn't work sometime. Looking at "Charles" I can see they all call to the amf controller. Very puzzling ....

Answer 3

use this in beforeFilter action of your controllere called by flash:

if ($this->action == 'flashCalledAction') {
    Configure::write('Security.level', 'medium');
    //Using instead the session specified
$this->Session->destroy();
$this->Session->id($_REQUEST['sessionId']);
$this->Session->start();

// We revert to the original userAgent because starting a new session modified it
$this->Session->write('Config.userAgent', $_REQUEST['userAgent']);
// We delete the flash cookie, forcing it to restart this whole process on each request
setcookie(Configure::read('Session.cookie'), '', time() - 42000, $this->Session->path);   
    }

then you have to pass these 2 params in each flash call to this controller:

param: 'userAgent' -> value: '$this->Session->read('Config.userAgent')' 
param: 'sessionId' -> value: $this->Session->id()

Answer 4

http://blogs.bigfish.tv/adam/2008/04/01/cakephp-12-sessions-and-swfupload/

This is specifically for swfUpload but the process of appending the session_id to the urls and the settings for checkAgent and session security are covered and should help point you in the right direction.

Answer 5

It appears that if you manage to call your Session->id($sessionId) before any call to Session->read(), Session->check() or Session->write(), you don't need to bother with all the destroy old session, update userAgent and delete cookie stuff.