Is there a way to hide the variables that are passed to Flash using swfobject when someone looks at the source?
I have Flash swfs which are embedded with swfobject and I pass some vars to them like user id. How do I prevent people from reading these vars? If anyone sees the source of a php page that has swfs embedded, they can see all the variables that are passed to flash. Is there a way to hide these vars? What are some other ways to do this? I thought about setting the ExternalInterface and calling a javascript function to pass vars to Flash - will this effectively hide the data I am sending?
thank
source to share
you cannot hide data. you can only make it harder to find it. using firebug or similar tools people will always know, as they can look at what the JS is doing and the data your application is sending. the best you can do is add some encryption, but with a decompiler it is easy to extract the decryption engine from the swf.
if you have described a general problem (what data is being sent and why / against what you want to protect), perhaps I could offer more specific ideas.
edit: this seems like a major security flaw to me. the restricted service should only grant access to authenticated users. The Flash client should never pass its user ID. instead, the session (created by the login) must be associated with the user, allowing for identification. therefore your client will never know his user id. it will just send a request and the PHP session will let you know that user id and provide the appropriate data.
source to share