A coworker of mine has been researching secure Flex 2 remote object calls to ColdFusion cfc’s over HTTPS. Seems simple enough, but anytime sensitive information is passed over the Internets I’d really like it to be bulletproof. Sure, I’m comfortable with HTTPS, but opening a flash swf over HTTP and trusting that it’s using HTTPS behind the scenes makes me a queasy system admin.
By default, a Flash movie can only access data through the exact domain where it was itself accessed. So, when you open a Flash swf over HTTP it can’t open a remote object over HTTPS to the same domain. The data host server can be tweaked to allow HTTP to HTTPS communication. But do I really want to make this tweak?
Adobe has this to say about it in a Flash tech note:
A secure server that allows access to movies hosted via a non-secure protocol
It is not advisable to permit HTTP content to access HTTPS content. This practice can compromise the security offered by HTTPS.
Most of the developers using our CF servers for Flex purposes are only using HTTPS for authentication. The rest of their app data is generally non-sensitive and doesn’t require encryption.
Is there really a security risk in opening a swf over HTTP and then making HTTPS remote object calls? If the endpoint is set in the Flex 2 app to an https address, all signs indicate that communication from the swf is going over HTTPS.
from what I know… if you access your SWF file via HTTPS… you can access HTTP and HTTPS but if you only access it by HTTP… then you can only access HTTP and I think the same applies to others aswell like Socket, FDS and so on
I just normally access my SWF files via HTTPS
@Jerome – No. You can definitely deliver your app and content files over http, and make SSL calls to your back end AMF services.
It depends on what type of app you are actually building, but I see security issues in delivering your swf over http but doing all your service calls over SSL. All you need to do is ensure your AMF channel endpoint is definitely https based, and you have your certificates all set etc.
As a sanity check, you can always use something like Charles or Service capture to ensure all your required service calls are actually https based…