Desktop Flex application login system

Question

I'm currently in the planning/early building phase of a desktop flex application that will be communicating to a Zend Application on a web server.

The flex app will basically be like a layout/view in terms of the MVC pattern, it will make requests to various controller actions and display the data returned in a meaningful way, and post data that will update various data in the database on the server.

Basically what I'm wondering is what the best way is to go about building a login system for the desktop application. Hopefully I'm correct in assuming that I can't use the regular channels that you would if your users were accessing the application via a browser, so I was thinking I would do this:

1. Flex app posts login details (email, password) to a login action
2. The login action uses Zend Auth to check if the details are valid
3. The login action creates a unique hash (and stores it in the db somewhere along with the user's id) and returns a json object containing the hash along with the user's id to the flex app
4. Whenever the flex app makes requests to any action in the web app, it also sends along the user's id and the unique hash so the web app can verify the user.

Does this make sense, or am I barking up the wrong tree here?

Let me know what you think, and whether there's a better solution I should look into.

Thanks!

Answer 1

Yes it makes sense what you're doing, I have built a similar system but, in this case I use Basic authentication, that way when I send an HTTPService to the server, I include the hash (token) on the header.

I'm using an API that was built by a coworker where he sends me a token when I make a login action.

The header information that I sent looks like this:

myHttpService.headers = {Authorization:"Basic " + encoderString};   

The encoderString variable is made using the username and token that the server returns to me when I am logged, I use these variables to create the encoderString:

var encoder:Base64Encoder = new Base64Encoder();
var encoderString:String;    

encoder.encode(login+":"+token);
encoderString=Basics.encoder.toString();

Answer 2

Look into Apache Shiro, it's a really cool and SIMPLE to use security library which requires minimal dependencies, little configuration, and does not give a hoot whether you're building an old school HTML app, Flex rich client web app, or a desktop Flex/AIR (or even Swing) application.