views:

201

answers:

3

I've written some fancy Flex app, which doesn't really require any server side integration.

Now if someone took that SWF and put it in their server then it will very well run.

What code can recognize that the SWF is not under my domain and stop from execution during startup? I don't mind making some server side calls just to do a check. But how can this be achieved?

+1  A: 

Why don't you just watermark your app? But I think if someone steals your app, he would hack it too, to remove any protection.

Thomas
That's an option but I don't want the SWF to run at all. There are sites which take your SWF and host it on their website even if it's watermarked! Sad but true.
Yeti
+4  A: 

Check out loaderinfo.url, it can do this for you. Here's an example on how it can be used to determine where the SWF is being loaded from.

So, you could detect where the swf is loading from, and if it's not from your server, block out the good stuff. :)

Good luck

sthg
I'm sure you can remove or edit this security check after decompiling the swf.
Thomas
@Thomas That's not impossible, but at least the thief would do some work.
Amarghosh
+1  A: 

As has been mentioned the bottom line is anything you can put in, the baddie can rip right out, so all that you can really do is make the amount of work necessary to do this an obstacle to anyone even trying. What has been suggested so far would at least deter the casual thief and maybe that's enough.

The way I found around it was to actually have quite a tight integration with server-side data, such that even if you removed all of that integration (which would most likely take you days ... it's a big app) you would still have no data at all with which to use it. This obviously depends quite a lot on what your app is doing in the first place, but if you make an architectural decision to move any data over to the server side that will increase your protection.

(This should really be a comment rather than an answer, but posting here due to length.)

BinarySolo