Flex Inheriting Logged in User

views:

answers:

Flex Inheriting Logged in User

I am trying to secure my Flex application within my Java web application. Currently my Java web application, handles logging and managing user accounts and the like. I was wondering if there is a way to essentially share that user credentials with the Flash movie in a secure mechanism? For instance, if you log in, we want you to be able to save items in the Flex application for that user, only if that user is logged in of course. Any ideas? Any help is greatly appreciated.

Update: I apologize for the vagueness. I'm running Tomcat 5.5, Java 6 doing portlet development inside a Vignette Portal. All data communication is via Blaze DS. In our environment, we have data services and the portal handles logins, user management and the like. Currently we are simply passing down the username to the flash movie, which I don't feel is very secure.

You can pass data to a flash movie using flashVars which can be generated in a JSP. The data can be a one-time key generated on the server and associated with a user id. The Flex application can then take the key and use it to log in via a webservice call. The server will then validate the key and allow access to the user's account.

fgb 2010-03-22 19:17:17

At what point would you invalidate the key? The session is terminated in the web client with the session based cookie expires.

Nick 2010-03-22 19:34:33

The key could be a one-time key and expire as soon as it's used, switching to the web-service session once it's authenticated. On the client-side, the session will expire when the page is changed, or can be synced via ExternalInterface calls. The server-side session can be destroyed at the same time as the HttpSession via a HttpSessionListener, or it can expire independently via a timeout.

fgb 2010-03-23 12:22:47

It is a very general question and it's hard to provide a good answer without knowing what is your current architecture. The Flex application is using the same web server as your web application? What are you using in order to discuss with the backend (web services, sockets, rtmp sockets)? If you are sharing the same web server you can access the same HTTP session and you can check if the user is logged in or not.

If you need to be aware in your Flex application that the user has just logged off from the HTML application or the session has expired you have several options, again depending on your architecture. Assuming that the HTML application was already was notified you can call through ExternalInterface a method from the Flex application. If not (session expired while you are using the Flex application) you will know when trying to save your data.

Cornel Creanga 2010-03-23 10:51:18

Updated question with architecture. The Flex application, is just a component of the web application, its not THE application per se. In our instance the portal is responsible for indicating if the user is or is not logged in. As it is a purchased product, its not easy to get into the internals and change what I need to. Which leads me back to the initial question of securely sharing the credentials between essentially the two applications, even though they are served via the same container.

Nick 2010-03-23 14:01:28

ansaurus

tags:

views:

answers:

Flex Inheriting Logged in User

related questions