database security with php page that spits out XML

views:

answers:

+1 Q:

database security with php page that spits out XML

Hello,

I just created a PHP page that spits outs some data from my database in an XML format. This data is fetched from a flex application I made.

I had spent a long time formatting my tables and database information and do not want anyone to be able to simply type www.mysite.com/page_that_spits_out_XML.php and steal my data. However, at the same time I need to be able to access this page from my flex application.

Is there a way I can prevent other people from doing this? Thank you!

Are you using Flex's HTTPService object?

A few general ideas...

Create a Session or Cookie authentication scheme on your web service
Add some type of API key that Flex passes to your XML web service, which would provide a basic safeguard (though it can easily be detected and doesn't provide much in terms of security as it's visible in the postdata).
Use something like HTTP basic authentication: http://geekzguru.wordpress.com/2008/07/04/howto-add-basic-authentication-header-to-httpservice/

mmattax 2010-04-08 20:12:34

Get your flex app to send a secret key (hash or something) and then get your PHP to check if who is accessing it has a correct key. Might want to use a POST request to hide what you are sending. This isn't super secure but that's my two cents!

Abs 2010-04-08 20:15:49

The only thing that is really going to slow down a datathief is encryption, make sure that your flex app is obfuscated and that the key and the encryption function stored within is neither guessable nor easily extractable.

This is the best you can do, but it's not a type of solution I would generally recommend. If someone REALLY want that data they are going to get it.

eBusiness 2010-04-08 20:47:56

@Everyone, please keep on voting down without challenging what I wrote or providing a better solution. It's soooooo constructive!

eBusiness 2010-04-09 00:02:39

I didn't downvote - but what you are recommending is wrong. Obfuscation is never a solution. An attacker can just watch the http traffic and extract the key from there. Its not going to slow him down at all.

sri 2010-04-09 07:37:07

The key should be within the program, not stored as plaintext in there, but rather as a few lines generating it, thereafter mixed further by an obfuscation program. An attacker would then have to either decompile the program or run it in a debugger to figure out what is going on internally.But I think we generally agree, it's not really a solution, it's just a minor obstruction.

eBusiness 2010-04-09 10:03:34

hey eBusiness, your comment is probably the best solution. I will most likely have to store the data internally as an XML file within the flex program itself and avoid an HTTPservice request all together (since apparently with an httpservice request you can still see the XML output from the flex application with a general browser debugger --and this is what I was trying to avoid). Thanks for the help!

Rees 2010-04-12 17:43:51

+1 A:

You need to set up an authentication. The Flex application sends HTTP POST data (typically a username and a password) to the server where your PHP application checks whether the account exists and if it does, it sets up a session. Whenever accessing a file (such as the page_that_outputs_xml.php), the PHP file will check whether the account in the session has a permission to view this data.

That would be as bulletproof as today's most login systems.

Kai Sellgren 2010-04-09 11:35:09

ansaurus

tags:

views:

answers:

database security with php page that spits out XML

related questions