Flash 访问 https 资源时会发生什么？
如果位于 http://example.com/test.swf 的 swf 向 https://secure.com/webservice.xml，会发生什么？ Adobe 关于跨域策略文件的文档指出了“安全”属性。
安全：[仅限 HTTPS 和套接字， 可选] 指定是否可以访问 仅授予 HTTPS 文档 指定的来源（true）或所有 来自指定来源的文件 （错误的）。如果安全未指定 HTTPS 策略文件，默认为 真的。在 HTTPS 策略中使用 false 不推荐使用该文件，因为 损害了所提供的安全性 HTTPS；例如，允许 中间人攻击以获得 访问受保护的 HTTPS 数据 策略文件。
这是否意味着 Flash 播放器实际上会发出 HTTP 请求，而不是 HTTPS？问题是否是对从非安全域提供的 .swf 文件的信任度较低？如果 Flash 播放器发出正确的 SSL 请求，我看不出额外的中间人漏洞来自何处。如果没有，我想网络服务器可能会被配置为拒绝它。
If a swf located at http://example.com/test.swf makes a request to https://secure.com/webservice.xml, what happens? Adobe's documentation on cross domain policy files notes the "secure" attribute.
secure: [HTTPS and Sockets only,
optional] Specifies whether access is
granted only to HTTPS documents from
the specified origin (true) or to all
documents from the specified origin
(false). If secure is not specified in
an HTTPS policy file, it defaults to
true. Using false in an HTTPS policy
file is not recommended because this
compromises the security offered by
HTTPS; for example, allowing
man-in-the-middle attacks to gain
access to the HTTPS data protected by
the policy file.
Does this mean the Flash player will actually make an HTTP request, rather than HTTPS? Is the issue that there's a presumption of less trust for .swf files being served from a non-secure domain? If the Flash player makes a proper SSL request, I don't see where the additional man-in-the-middle vulnerability comes from. And if it doesn't, I have to think the web server would probably be configured to reject it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
没有。如果将属性
secure设置为false，Flash 应用程序将不会发出http请求。它将向通过https发布的源发出https请求。但主要思想是，将此属性设置为false允许 Flash 与其他http资源建立连接。此时就可以发起“中间人”攻击。想象一下情况。您的 Flash 应用程序从https加载一些文档，并使用其 api 在某个 Web 服务器上处理它们，但通过http（不安全）连接。从https加载的数据将由 Flash 通过简单的http传递到 Web 服务器。如果您将secure属性设置为true，这将告诉 Flash 来自https的文档需要安全性。从那时起，Flash 就不会再发出简单的http请求，因为来自https的数据可能会被程序算法插入到这个不安全的请求中。Nope. If you set attribute
securetofalseFlash application wouldn't make anhttprequest. It would makehttpsrequest to source that is published throughhttps. But the main idea is that this attribute set tofalseallows Flash to make connections to otherhttpresources. "Man in the middle" attack could be made in this moment. Imagine situation. Your Flash application loads some documents fromhttps, and process them on some web server, using it's api, but throughhttp, not secured, connection. Data that was loaded fromhttpswould be passed by Flash to web server through simplehttp. If you setsecureattribute totruethis will tell Flash that documents fromhttpsrequire security. And Flash would not make simplehttprequest from that time anymore, because data fromhttpscould be probably been inserted in this not secure requests by program algorithm.