当有人查看源代码时，有什么方法可以隐藏 swfobject 传递给 Flash 的变量吗？
我有一些使用 swfobject 嵌入的 Flash swf，我向它们传递了一些变量，例如用户 ID。我如何防止人们阅读这些变量？如果有人查看嵌入 swf 的 php 页面的源代码，他们可以看到传递给 flash 的所有变量。有没有办法隐藏这些变量？还有什么其他方法可以做到这一点？我考虑过设置一个ExternalInterface 并调用一个javascript 函数来将变量传递给Flash - 这会有效地隐藏我正在发送的数据吗？
谢谢
I have some Flash swfs that are embedded using swfobject and I pass them some vars like user id. How do I prevent people from reading these vars? If someone views the source of the php page that embeds the swfs they can see all the variables that are being passed to flash. Is there a way to hide these vars? What other ways are there to do this? I have thought about setting up an ExternalInterface and calling a javascript function to pass the vars to Flash - would this effectively hide the data I am sending?
thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您实际上无法隐藏数据。你只会让事情变得更难找到。使用 firebug 或类似的工具，人们总会找到答案，因为他们可以查看你的 JS 做了什么，以及你的应用程序发送的数据。您能做的最好的事情就是添加一些加密，但是使用反编译器，可以轻松地从 swf 中提取解密机制。
如果您描述了一般问题（正在发送什么类型的数据以及为什么/针对您希望保护的数据），也许我可以提供更具体的想法。
编辑：对我来说这似乎是一个严重的安全缺陷。受限服务应该只向经过正确身份验证的用户授予访问权限。 Flash 客户端不应传递其用户 ID。相反，会话（由登录创建）应与用户相关联，从而允许识别。所以你的客户永远不会知道它的用户 ID。它只会发送一个请求，PHP 会话将允许找到该用户 ID 并提供相应的数据。
you cannot actually hide the data. you can only make it harder to find. using firebug or similar tools, people will always find out, since they can look at what your JS does, and at the data your app sends. the best you can do is to add some encryption, but using a decompiler, one can easily extract the decryption mechanism from the swf.
if you described the general problem (what kind of data is being sent and why/against what you want it protected), maybe I could provide more specific ideas.
edit: this seems like a serious security flaw to me. a restricted service should only grant access to properly authenticated users. the flash client should never pass its user id. instead, a session (as created by a login) should be associated with a user, thus permitting identification. so your client will never even know of its user ID. it will just send a request and the PHP session will permit to find out this user ID and provide the corresponding data.