What's the best way to save user login and password in flex?

Question

Hello.

What's the best way to save user credentials in flex? Local storage doesn't seem like good place for storing confidential data, because it saves information as a plain text.

Answer 1

User credentials are normally stored in a session variable.

Answer 2

You can use ExternalInterface to communicate with JavaScript and store data in browser cookies.

Don't store users' name or password in cookies - create a session in the server with credentials in it, and store the session id in the browser cookies.

Answer 3

You shouldn't. Use browser cookies or a session token to identify the user to the server. For instance:

1. User enters username and password into a form in Flex and clicks login.
2. Server validates credentials. Then either in memory or in a database the server associates a random (and sufficiently secure) token with the user. Then the server returns the token to the client.
3. Client saves the token in either a cookie, LocalSharedObject, or just in memory. Then subsequent requests also include the token.

Answer 4

Hi Dr. Noise

You don't necessarily need to save the credentials as plain text in Local Storage; in fact, Local Storage (SharedObject) is actually serialized as AMF, so it's not plain text to begin with. Whatever medium you use to store your sensitive data, you should certainly consider using some sort of hashing or encryption techniques like SHA1 or RSA.

The difference between hashing and encryption is this:

• Hashing (SHA1, MD5, etc) is a one-way encryption - in other words, it's very difficult to determine the original value of the hashed value, so what you can do is compare one hashed value to another since these hashing algorithms will always spit out the same thing.
• Encryption (RSA, AES, etc) is a two-way encryption - in other words, you can determine the original value of the encrypted data, usually by using a public/private key combination

It really depends on what you're trying to do.

Hope you come right