模糊或隐藏 PHP-AS3 项目中使用的路径的最简单方法是什么
我正在开发一个使用 PHP 、 AS3 和 AMFPHP 的项目。
该项目允许用户上传和下载图像等。由于我对 PHP/FLash 安全性相当陌生，因此我一直在尝试收集尽可能多的有关使事情尽可能安全的信息。我有一些关于使用 .htaccess 文件的好建议，以及一些其他技巧。
我目前的主要问题是如何隐藏往返于 PHP/assets/ 和往返于 AMFPHP 服务的“路径”信息...
目前我将所有路径硬编码在一个 .as 中，返回一个对象以及任何需要/请求它的其他类的路径。我发现这种方法效果很好，因为我只需要更改这个 .AS ，它就会扩展到需要它的其他类。
我并不非常担心其他人反编译我的代码，如果他们真的想要的话，他们可能可以“嗅出”路径。我最关心的是允许其他人轻松访问我的所有 AMFPHP 服务，或者允许其他人访问我不希望他们访问的部分网站。基本上我意识到无论如何事情都不会100%安全，但想采取预防措施。
所以我的主要问题是...... 隐藏/隐藏 PHP-AS3 项目中使用的路径的最佳、最简单的方法是什么？ ...如果需要的话，我考虑了 PHP 甚至 SQL 数据库的可能性。我宁愿不花大量的时间和金钱在有问题的混淆软件上，除非有一个经过验证的真实（而且便宜）的闪存（而不是柔性）软件。 ..我目前没有 SSL，但不知道有多重要 - 这很常见。 --
I am working on a project that uses PHP , AS3, and AMFPHP .
The project allows users to upload and download images among other things. Since I am fairly new to PHP/FLash security I have been trying to gather as much info about making things as secure as possible. I've got some good advise about using .htaccess files, and a few other tricks.
My main question at the moment is how to hide the "path" info from and to the PHP / assets / and to and from the AMFPHP services ...
Currently I have all the paths hard-coded in one .as that returns an object with the paths to any of the other classes that need/request it. I found this method to work well since I only need to change this one .AS , and it will branch out to the other classes that need it.
I'm not super worried about others decompiling my code, and they could probably "sniff" out the paths if they really wanted. I'm mostly concerned with allowing others easy access to all of my AMFPHP services or being allowed to parts of the site I do not wish them to be. basically I realize that things aren't gonna be 100% secure regardless, but would like to take precautions.
So my main question is ...
Whats the best- simplest way to obscure / hide the paths being used in a PHP - AS3 project ? ... I entertained the possibly of PHP includes or even a SQL database if need be. I rather not spend a bunch of time and money on questionable obfuscatory software, unless there's a tried and true ( and inexpensive) one for flash (not flex). .. and I currently do not have a SSL but don't know how critical - common this is. --
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
正如您所指出的，任何人都可以通过使用 Wireshark 来查看发送到您网站的流量，或者使用 Flash 反编译器来查看您的源代码并直接找到链接，从而找到您的路径。
我认为尝试隐藏你的路径听起来不值得，因为它只会增加一层轻微的模糊性。任何感兴趣的人都可以相对轻松地弄清楚这一点，但普通人对如何对您的一项服务进行 AMF 调用一无所知。相反，我会集中精力使您的 AMFPHP 函数本身尽可能安全。
As you've noted, anyone could find out your paths by using Wireshark to watch traffic sent to your site, or a Flash decompiler to look at your source code and find the links directly.
I don't think it sounds worth the trouble to try to hide your paths, since all it would be adding is a slight layer of obscurity. Anyone interested could figure it out with relatively little effort, but the average person would have no clue whatsoever about how to make an AMF call to one of your services. Instead, I'd concentrate on making your AMFPHP functions themselves as secure as possible.
您可以使用 mod_rewrite 文件（使用 Apache）来删除或更改页面的文件扩展名。
请参阅http://www.workingwith.me.uk/articles/scripting/mod_rewrite 了解更多示例。
这不会改变闪存中硬编码的链接，但可能会使它们对用户来说不那么明显。
如果您使用的是 Windows，那么您可以使用 OBFU 来混淆您的 Flash 代码。它很昂贵但非常安全。有一些开源替代方案，但不那么安全。
请参阅 http://tech.motion-twin.com/obfu.html
但是什么Code Duck 的说法是正确的，因为没有办法完全保护它。
You could use a mod_rewrite file (with Apache) to remove or change the file extensions for your pages.
See http://www.workingwith.me.uk/articles/scripting/mod_rewrite for more examples.
This would not change the links hardcoded in flash but could make them less obvious to a user.
If you are using Windows then you can use OBFU to obfuscate your flash code. It is Expensive but very secure. There are a few open source alternatives but not as secure.
See http://tech.motion-twin.com/obfu.html
But what Code Duck is saying is correct in that there is no way to completely protect it.