RE: [flexcoders] CFlogin, SetCredentials and the RemoteObject

Fri, 27 May 2005 16:33:21 -0700

Yep - the "named" object just serves as an alias to a service, such as a POJO (or in your case, CFC), that helps out in two respects... a) it allows you to create a name for a service that protects your code from package/directory/file renames of the service, b) doesn't expose underlying system structure which plays into the security tenet that the less the public knows about your application the better.
 
In this case, however, it means that the server has to understand the name (alias) that you're specifying... a feature that was introduced in Flex but only introduced to CF in version 7 with the update of the gateway. That is, named objects for cfc-based services only work with CFMX 7 with a correctly configured gateway-config.xml file.
 
 

From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of dave buhler
Sent: Friday, May 27, 2005 4:42 PM
To: [email protected]
Subject: Re: [flexcoders] CFlogin, SetCredentials and the RemoteObject

Hi Peter,

I'm assuming the CFC is the object?

What are the benefits of registering the named objects in the gateway-config file?
Is there an informal list of best-practices for security when working with remoting? I would understand if MM couldn't comment on suggesting best practices for security.

Dave


On 5/27/05, Peter Farland <[EMAIL PROTECTED]> wrote:
Ok. I believe you can register named objects for CFCs in CFMX 7's copy of gateway-config.xml as it shares essentially the same code as Flex 1.5's gateway - (though note this would be a Flex concept being introduced into a CF/Flash Remoting world) let me know if you are having any difficulties.

From: [email protected] [mailto:[email protected]] On Behalf Of dave buhler
Sent: Friday, May 27, 2005 3:03 PM

To: [email protected]
Subject: Re: [flexcoders] CFlogin, SetCredentials and the RemoteObject

Hi Peter,

MX 7 installed on JRun4

Dave

On 5/27/05, Peter Farland <[EMAIL PROTECTED]> wrote:
What version of CF are you using Dave?

From: [email protected] [mailto: [email protected]] On Behalf Of dave buhler
Sent: Friday, May 27, 2005 10:36 AM
To: [email protected]
Subject: Re: [flexcoders] CFlogin, SetCredentials and the RemoteObject

Thanks!

On 5/27/05, Indy Nagpal <[EMAIL PROTECTED]> wrote:
Yes, I think that is the logic behind "named" objects.


On 5/27/05, dave buhler <[EMAIL PROTECTED]> wrote:
>  Interesting...
>
>  So if I use the named remote objects in the flex-config file, the paths to
> the CFCs aren't visible?
>
>  I should use a decompiler on my own app to see, but I had assumed the paths
> would be compiled.
>
>  Dave
>
>
> On 5/26/05, Indy Nagpal < [EMAIL PROTECTED]> wrote:
> >
> > Have you looked at creating named remoteobjects? That way even though
> > the methods might be visible in the decompiler, but path to the actual
> > cfc won't be.
> >
> > Hmm... regarding your swf file finally being part of cfm page... I've
> > find myself more comfortable with "standalone" flex apps (that
> > interact with CF through remoteobject) rather and flex apps embedded
> > in cfm pages. I find debugging quite painful when a flex app is embbed
> > in a cfm page.
> >
> > Indy
> >
> > On 5/27/05, dave buhler < [EMAIL PROTECTED]> wrote:
> > >  I was debating if I should have my login page exist within HTML or as a
> > > sep., stand alone MXML page.
> > >
> > >  I mention it because I'm pretty sure the CFC method names and service
> names
> > > would be visible to a decompiler and thus, visible to any user who
> stumbles
> > > across the Flex Admin system or has just simple access to the Login
> screen,
> > > if the login is part of the overall Admin SWF.
> > >
> > >  Ultimately, my MXML will be a CFM page and I was going to only show the
> > > Flex SWF if the session is valid, otherwise, kick them back to the sep.
> > > login page.
> > >
> > >  Any thoughts?
> > >
> > >  Dave
> > >
> > >
> > > On 5/25/05, Indy Nagpal < [EMAIL PROTECTED]> wrote:
> > > >
> > > > Hi Dave:
> > > >
> > > > Here is my setup, I don't know if this helps.
> > > >
> > > > I have a CF application where users need to login. Once they
> > > > successfully plug in their username and password, their session is
> > > > setup (I'm using jessionid). I have a cfc (with relevant functions for
> > > > login/logout) that is used for authenticating users and setting up
> > > > session.
> > > >
> > > > I call that cfc as remoteobject, firing the login function in the cfc,
> > > > passing it the username and password. If the login is successful, the
> > > > session for the user is setup and all is sweet. I can access the
> > > > user's session info through the same cfc (i have a function that
> > > > returns their session structure Flex. And my Flex code can then look
> > > > at the session object of the user and do what it needs to.
> > > >
> > > > I think the key for you would be to get jsessionid going, along with
> > > > using functions within a cfc to validate the user and return user's
> > > > session (or any other value that you want to return to flex).
> > > >
> > > > Indy
> > > >
> > > >
> > > >
> > > >
> > > > On 5/26/05, dave buhler <[EMAIL PROTECTED]> wrote:
> > > > >  Hi Indy,
> > > > >
> > > > >  I understand setting up perhaps the username and password as a
> session
> > > > > variable.
> > > > >
> > > > >  Can you show me an example of how you are passing over the username
> and
> > > > > password in the remote object? I can see adding it as something like
> the
> > > > > following on each request:
> > > > >
> > > > >  service.getKittens(loginVO,kittensVO)
> > > > >
> > > > >  ...but was wondering if there was another method that is used
> directly
> > > with
> > > > > the remote object configuration.
> > > > >
> > > > >  Dave
> > > > >
> > > > > On 5/24/05, Indy Nagpal < [EMAIL PROTECTED] > wrote:
> > > > > > Hi Dave:
> > > > > >
> > > > > > I've never tried using RemoteObject with cflogin, but RemoteObject
> > > > > > works very nicely with CF session variables, so it should be able
> to
> > > > > > pass that information to your application. To get it to work with
> > > > > > session variables, I was using CF and Flex on the same server, and
> had
> > > > > > turned on jsessionid (in CF Admin).
> > > > > >
> > > > > > Indy
> > > > > >
> > > > > > On 5/23/05, dave buhler < [EMAIL PROTECTED] > wrote:
> > > > > > >  Does the RemoteObject permit the passing of a username and
> password
> > > to
> > > > > a
> > > > > > > CFLogin tag? I want to create an instance of NetConnection and
> > > include
> > > > > > > setCredentials(username,password) to pass over
> to
> > > my
> > > > > remote
> > > > > > > object for a valid user check on each request. If it's not
> supported
> > > in
> > > > > > > Flex, does anyone have any suggestions so that we can ensure a
> valid
> > > > > > > username and password is part of each remote CFC request.
> > > > > > >
> > > > > > >  Best,
> > > > > > >   mx.controls.Alert.show('Dave')
> > > > > > >
> > > > > > >  ________________________________
> > > > > > >  Yahoo! Groups Links
> > > > > > >
> > > > > > >
> > > > > > > To visit your group on the web, go to:
> > > > > > > http://groups.yahoo.com/group/flexcoders/
> > > > > > >
> > > > > > > To unsubscribe from this group, send an email to:
> > > > > > > [EMAIL PROTECTED]
> > > > > > >
> > > > > > > Your use of Yahoo! Groups is subject to the Yahoo! Terms of
> Service.
> > > > > >
> > > > > >
> > > > > >
> > > > > > Yahoo! Groups Links
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >  ________________________________
> > > > >  Yahoo! Groups Links
> > > > >
> > > > >
> > > > > To visit your group on the web, go to:
> > > > > http://groups.yahoo.com/group/flexcoders/
> > > > >
> > > > > To unsubscribe from this group, send an email to:
> > > > > [EMAIL PROTECTED]
> > > > >
> > > > > Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.
> > > >
> > > >
> > > >
> > > > Yahoo! Groups Links
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >  ________________________________
> > >  Yahoo! Groups Links
> > >
> > >
> > > To visit your group on the web, go to:
> > > http://groups.yahoo.com/group/flexcoders/
> > >
> > > To unsubscribe from this group, send an email to:
> > > [EMAIL PROTECTED]
> > >
> > > Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.
> >
> >
> >
> > Yahoo! Groups Links
> >
> >
> >
> >
> >
> >
> >
>
>
>  ________________________________
>  Yahoo! Groups Links
>
>
> To visit your group on the web, go to:
> http://groups.yahoo.com/group/flexcoders/
>
> To unsubscribe from this group, send an email to:
> [EMAIL PROTECTED]
>
> Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.



Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/flexcoders/

<*> To unsubscribe from this group, send an email to:
     [EMAIL PROTECTED]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/





Yahoo! Groups Links


Yahoo! Groups Links


Yahoo! Groups Links

Reply via email to