Deserialize AmfPhp messages

Question

Is it possible to deserialize the AmfPhp messages while remoting?

They are in binary, and assuming that amfphp understands what they are I should be able to decode what it s.

How to ? is this considered a security issue?

Answer 1

AMF data sent over HTTP is indeed binary, and can be decoded. You can use a debugging proxy like Charles to examine the contents of the AMF, and look at the objects that are passing back and forth.

So, under HTTP AMF provides no security by itself, for secure AMF you need to use HTTPS.