<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress/2.1.3" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
<channel>
	<title>Comments on: Securing AMFPHP 1.9 via Authentication</title>
	<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/</link>
	<description>RIA, embedded programming, what else!</description>
	<pubDate>Thu, 11 Mar 2010 18:23:20 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.1.3</generator>

	<item>
		<title>By: Omid</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-153</link>
		<author>Omid</author>
		<pubDate>Wed, 11 Jun 2008 19:39:22 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-153</guid>
					<description>Very useful
TNX</description>
		<content:encoded><![CDATA[<p>Very useful<br />
TNX</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: The Flash Blog &#187; AMFPHP Security Basics</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-186</link>
		<author>The Flash Blog &#187; AMFPHP Security Basics</author>
		<pubDate>Wed, 06 Aug 2008 03:53:07 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-186</guid>
					<description>[...] thrown. It is inside this function that you can do some type of authentication. Joshua Ostrom has a nice blog post that goes into more details on [...]</description>
		<content:encoded><![CDATA[<p>[&#8230;] thrown. It is inside this function that you can do some type of authentication. Joshua Ostrom has a nice blog post that goes into more details on [&#8230;]</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: Segurança Flash + PHP + AMFPHP &#124; Webcore Blog</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-190</link>
		<author>Segurança Flash + PHP + AMFPHP &#124; Webcore Blog</author>
		<pubDate>Thu, 14 Aug 2008 23:31:07 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-190</guid>
					<description>[...] básicas; Tutorial de integração em vídeo; Autenticação; as3corelib - biblioteca com classes [...]</description>
		<content:encoded><![CDATA[<p>[&#8230;] básicas; Tutorial de integração em vídeo; Autenticação; as3corelib - biblioteca com classes [&#8230;]</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: Ben Throop</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-198</link>
		<author>Ben Throop</author>
		<pubDate>Wed, 03 Sep 2008 22:05:32 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-198</guid>
					<description>Good post. Do you know if it's possible to return different values when beforeFilter fails? I want one failing state to return a message that says "This happened" and the other failing state to return a message that says "That happened". The problem is that AMFPHP is the one sending the fault and it always comes back as:

faultCode	String	AMFPHP_AUTHENTICATE_ERROR
faultDetail	String	/amfphp/core/shared/app/BasicActions.php on line 121
faultString	String	Method access blocked by beforeFilter in PublisherService class

Any ideas?</description>
		<content:encoded><![CDATA[<p>Good post. Do you know if it&#8217;s possible to return different values when beforeFilter fails? I want one failing state to return a message that says &#8220;This happened&#8221; and the other failing state to return a message that says &#8220;That happened&#8221;. The problem is that AMFPHP is the one sending the fault and it always comes back as:</p>
<p>faultCode	String	AMFPHP_AUTHENTICATE_ERROR<br />
faultDetail	String	/amfphp/core/shared/app/BasicActions.php on line 121<br />
faultString	String	Method access blocked by beforeFilter in PublisherService class</p>
<p>Any ideas?</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: Joshua</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-200</link>
		<author>Joshua</author>
		<pubDate>Mon, 08 Sep 2008 12:22:49 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-200</guid>
					<description>Ben,
  Take a look at line 120 of AMFPHP's core/shared/app/BasicActions.php.  Here's the code
  
  
if ($allow === '__amfphp_error' &#124;&#124; $allow === false) {
	$ex = new MessageException(E_USER_ERROR, "Method access blocked by beforeFilter in " . $className . " class", __FILE__, __LINE__, "AMFPHP_AUTHENTICATE_ERROR");
	MessageException::throwException($amfbody, $ex);
	return false;
} 


You could do something along the lines of

if ($allow !== true)
{

   if($allow === '__amfphp_error' &#124;&#124; $allow === false)
	$ex = new MessageException(E_USER_ERROR, "Method access blocked by beforeFilter in " . $className . " class", __FILE__, __LINE__, "AMFPHP_AUTHENTICATE_ERROR");
    else
	$ex = new MessageException(E_USER_ERROR, $allow . " " . $className . " class", __FILE__, __LINE__, "AMFPHP_AUTHENTICATE_ERROR");
    
	MessageException::throwException($amfbody, $ex);
	return false;     
}

Where you return the error string (instead of false) from your before filter.  If you *do* return false from your before filter, the legacy AMFPHP error is thrown.

Hope that helps!!</description>
		<content:encoded><![CDATA[<p>Ben,<br />
  Take a look at line 120 of AMFPHP&#8217;s core/shared/app/BasicActions.php.  Here&#8217;s the code</p>
<p>if ($allow === &#8216;__amfphp_error&#8217; || $allow === false) {<br />
	$ex = new MessageException(E_USER_ERROR, &#8220;Method access blocked by beforeFilter in &#8221; . $className . &#8221; class&#8221;, __FILE__, __LINE__, &#8220;AMFPHP_AUTHENTICATE_ERROR&#8221;);<br />
	MessageException::throwException($amfbody, $ex);<br />
	return false;<br />
} </p>
<p>You could do something along the lines of</p>
<p>if ($allow !== true)<br />
{</p>
<p>   if($allow === &#8216;__amfphp_error&#8217; || $allow === false)<br />
	$ex = new MessageException(E_USER_ERROR, &#8220;Method access blocked by beforeFilter in &#8221; . $className . &#8221; class&#8221;, __FILE__, __LINE__, &#8220;AMFPHP_AUTHENTICATE_ERROR&#8221;);<br />
    else<br />
	$ex = new MessageException(E_USER_ERROR, $allow . &#8221; &#8221; . $className . &#8221; class&#8221;, __FILE__, __LINE__, &#8220;AMFPHP_AUTHENTICATE_ERROR&#8221;);</p>
<p>	MessageException::throwException($amfbody, $ex);<br />
	return false;<br />
}</p>
<p>Where you return the error string (instead of false) from your before filter.  If you *do* return false from your before filter, the legacy AMFPHP error is thrown.</p>
<p>Hope that helps!!</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: cooljackd</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-203</link>
		<author>cooljackd</author>
		<pubDate>Sat, 13 Sep 2008 02:59:56 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-203</guid>
					<description>hi how would you call the service from flash to validate the Authentication.</description>
		<content:encoded><![CDATA[<p>hi how would you call the service from flash to validate the Authentication.</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: Joshua</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-205</link>
		<author>Joshua</author>
		<pubDate>Fri, 19 Sep 2008 03:43:49 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-205</guid>
					<description>cooljack

Make a call to a php script that validates the login credentials.  If successful you could call

Authenticate::login($usrer,$roles);

and to destroy the session (logout)

Authenticate::logout();

Let me know if you need further assistance.</description>
		<content:encoded><![CDATA[<p>cooljack</p>
<p>Make a call to a php script that validates the login credentials.  If successful you could call</p>
<p>Authenticate::login($usrer,$roles);</p>
<p>and to destroy the session (logout)</p>
<p>Authenticate::logout();</p>
<p>Let me know if you need further assistance.</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: steve</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-226</link>
		<author>steve</author>
		<pubDate>Sun, 09 Nov 2008 03:47:45 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-226</guid>
					<description>what about the json.php file? How do you secure that? So someone can't run www.mysite/json.php/PHPclass.function/var1/var2/var3 ???</description>
		<content:encoded><![CDATA[<p>what about the json.php file? How do you secure that? So someone can&#8217;t run <a href="http://www.mysite/json.php/PHPclass.function/var1/var2/var3" rel="nofollow">www.mysite/json.php/PHPclass.function/var1/var2/var3</a> ???</p>
]]></content:encoded>
				</item>
	<item>
		<title>By: kevin</title>
		<link>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-242</link>
		<author>kevin</author>
		<pubDate>Thu, 15 Jan 2009 07:01:26 +0000</pubDate>
		<guid>http://www.joshuaostrom.com/2008/06/03/securing-amfphp-19-via-authentication/#comment-242</guid>
					<description>Hi,

I'm having a bit of trouble understanding how to implement this and was hoping you could point me in the right direction..

I defined a class as follows but when I call the getData method from Flex, it returns fine without any authentication occuring:

memberName) ? Authenticate::isUserInRole($this-&#62;$memberName) : true;
	}
	
	var $SecuredClassRoles = "admin";
	var $GetDataRoles = "admin";
	
	public function SecuredClass() {
		
	}
	
	public function GetData() {
		
		return "You Got In";
	
	} 

}

?&#62;

Also, I noticed you posted on Wade's site asking whether this is the 'best' way to implement auth - did he give you an answer or have you an updated opinion?

cheers!</description>
		<content:encoded><![CDATA[<p>Hi,</p>
<p>I&#8217;m having a bit of trouble understanding how to implement this and was hoping you could point me in the right direction..</p>
<p>I defined a class as follows but when I call the getData method from Flex, it returns fine without any authentication occuring:</p>
<p>memberName) ? Authenticate::isUserInRole($this-&gt;$memberName) : true;<br />
	}</p>
<p>	var $SecuredClassRoles = &#8220;admin&#8221;;<br />
	var $GetDataRoles = &#8220;admin&#8221;;</p>
<p>	public function SecuredClass() {</p>
<p>	}</p>
<p>	public function GetData() {</p>
<p>		return &#8220;You Got In&#8221;;</p>
<p>	} </p>
<p>}</p>
<p>?&gt;</p>
<p>Also, I noticed you posted on Wade&#8217;s site asking whether this is the &#8216;best&#8217; way to implement auth - did he give you an answer or have you an updated opinion?</p>
<p>cheers!</p>
]]></content:encoded>
				</item>
</channel>
</rss>
