Zend AMF 实现和 AMF 协议安全
我有一个 Flex 前端，通过 RemoteObject 连接到 Zend Framework 的 Zend Amf。这是我在客户端层 (Flex) 与应用程序层和持久层（带有 Zend Framework 的 LAMP）之间传输数据的唯一方法。 我可以解决安全问题的一些方法如下：
- 我可以通过在 services-config.xml 文件中使用 mx.messaging.channels.SecureAMFChannel 来解决 TLS 问题，并确保 Flash 播放器已加载到 HTTPS 包装器中，并且自 AMF 以来实际上正在使用 HTTPS协议位于 HTTP 之上
- RemoteObject 有一个 setCredentials 方法，我可以使用该方法传递 AMF 身份验证标头以保护用户相关数据。假设 TLS 实际上是安全的，我可以在对用户进行身份验证后公开端点上的方法。
- 我可以通过正确设置的 crossdomain.xml 来防止跨站点脚本和其他 FLASH 漏洞
我的问题是如何保护我的端点免受其他 AMF 用户的攻击？例如，如果除了我的 Flex 客户端之外还有另一个 AMF 使用者（不是 Flash，因此不受 crossdomain.xml 和 Flash 沙箱安全性约束）知道我的端点，那么什么会阻止它使用端点公开的方法？
据我所知，我本质上需要一种方法来针对我的 Zend Amf 端点验证我的 Flex 应用程序。在 AMF 消费者身份验证之后，我有了上面提到的一些安全机制来保护某些数据（例如用户身份验证）。我无法将某种身份验证机制嵌入到我的 Flex swf 中，因为 swf 很容易被反编译（swf 不可信）。虽然敏感数据通过用户身份验证受到保护，但未受保护的数据几乎不公开，但据我所知，完全开放供公众使用。
I have a Flex frontend connecting via RemoteObject to Zend Framework's Zend Amf. This is my only means to transport data between client layer (Flex) and the application and persistence layers (LAMP with Zend Framework).
Some ways I can address security are as follows:
- I can address TLS by using mx.messaging.channels.SecureAMFChannel in my services-config.xml file and ensuring Flash player is loaded into a HTTPS wrapper and is in fact using HTTPS since the AMF protocol is layered on top of HTTP
- RemoteObject has a setCredentials method with which I can pass AMF authentication headers to protect user related data. Assuming TLS was actually secure I can expose methods on the endpoint after authenticating the User.
- I can protect against cross-site scripting and other FLASH vulnerabilities with a properly set up crossdomain.xml
The question I have is how to I protect my endpoint against another AMF consumer? For instance, if there were another AMF consumer (not Flash so not bound by crossdomain.xml and Flash sandbox security) other than my Flex client that knew my endpoint, what would stop it from using methods that the endpoint exposes?
As far as I know I essentially need a way to authenticate my Flex application against my Zend Amf endpoint. After AMF consumer authentication, I have some of the security mechanisms I mentioned above to protect certain pieces of data (like User authentication). I can not embed some sort of authentication mechanism into my Flex swf because the swf is vulnerable to decompilation (the swf can not be trusted). While sensitive data is protected via User authentication the unprotected data is hardly public but as far as I can tell is totally open for public consumption.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您无法阻止任何人向您的端点发送任意 HTTP 请求。如果您的 Flex 应用程序根据服务器对用户进行身份验证，并且服务器仅在请求具有正确的凭据/会话 ID 时才提供敏感数据，那么一切都很好。您不能做的是对用户进行身份验证，并且仅将用户经过身份验证的信息存储在客户端中。由于 HTTP 是无状态协议，因此服务器必须能够单独授权每个请求。 “常规”网站和 AJAX 也是如此。
You cannot prevent anyone from sending arbitrary HTTP requests to your endpoint. If your Flex application authenticates users against the server, and the server only serves sensitive data if the request has proper credentials / session IDs on it, everything is fine. What you can not do is authenticate the user and only store within the client that the user is authenticated. Since HTTP is a stateless protocol, the server must be able to authorize each request individually. It's the same thing with "regular" websites and AJAX.
除非提供某种身份验证，否则 AMF 客户端无法知道是谁调用了它们。 Flex 发送的任何 HTTP 请求都可以通过非 Flex 方式进行模拟，并且正如您正确指出的那样，可以提取任何嵌入的密钥。因此，对此没有通用的解决方案，但如果您提供 HTTPS 连接的客户端证书并让服务器检查客户端证书，您可能可以解决一些问题。
AMF client can not know who called them unless some sort of authentication is provided. Any HTTP request that Flex sends could be emulated by non-Flex means, and as you correctly noted, any embedded key could be extracted. So there's no generic solution for this, though you could probably work something out if you gave your client certificates for HTTPS connection and made the server check the client certificates.