views:

23

answers:

1

Hello.

I want to write a flash application that uses the facebook javascript api. for the flash application to use it, I'd have to write the secret and api key in the flash application. as far as i know every flash application can be decoded and the api key and secret key can be revealed. is there a way to properly protect those keys?

A: 

I would suggest retrieving it from a secure location on your server. The server should look if the request comes from your domain, and only return the API key if it's the case.

sharvey
in general a user can decompile my flash or sniff my network to see the exact request that is begin sent to the server. open my facebook application on his browser and use firebug to replace my swf file with his swf file that does the same request and displays them on the screen
ufk