Comments on: Firefox, Flex URLRequest, and Sessions Issue

By: Frank Metal

Frank Metal — Thu, 11 Feb 2010 23:44:39 +0000

Thanks, my problem was solved passing the session id back to php
And in php I do as follows:

session_id($_POST['sid']);
session_start();

Hope this help others

By: Artem Brigert

Artem Brigert — Wed, 09 Dec 2009 11:11:41 +0000

Great !
same problem has also Flash 10 + FF + MP3, request.url = urlVar+”?rand=”+Math.random();

Thank you!

By: mankenler

mankenler — Thu, 20 Aug 2009 12:15:57 +0000

In Flash 9, the techniques described above (for the LoadVars class) do not work for any browser-provided header (e.g. User-Agent, Host and Referer), nor probably for many “protected” headers such as Content-Length. Still, headers like Expect can be sent, so some attacks (e.g. Example 1 above) are still effective with Flash 9.

By: Perilin

Perilin — Tue, 04 Aug 2009 06:53:23 +0000

Yep, found that out too a bit later on. My project was for a closed LAN and it worked perfectly (I’m guessing Flash player assumes local IPs are “trusted” or some such). I’ve been trying to fool it into thinking any IP is trusted but no luck. My only other guess would be to develop some sort of “proxy” script using the session-id-on-url trick that then hands the data over to the ‘s authentication and uploading system.

In the system I used (JAWS CMS) it gets the session ID exclusively from the cookie, so the GET trick won’t work, ergo a proxy script is the best bet.

Best of luck!

By: HELP!

HELP! — Mon, 03 Aug 2009 20:20:19 +0000

So how did he get it to work?

By: HELP!

HELP! — Mon, 03 Aug 2009 20:19:56 +0000

Looking at Perlin’s comment’s but perlexed:

That method produces:
ArgumentError: Error #2096: The HTTP request header Cookie cannot be set via ActionScript.
at flash.net::URLStream/load()
at flash.net::URLLoader/load()

Compiling using Flex Builder 3.

Why?

Have done some research and found that not allowing this is secruity feature in newer flash players:
From.. : http://www.securiteam.com/securityreviews/5KP0M1FJ5E.html

By: konyachat

konyachat — Sun, 02 Aug 2009 09:47:43 +0000

thankyou

By: Perilin

Perilin — Tue, 14 Jul 2009 11:23:49 +0000

I had the same problem, but appending the session id to the url didn’t work.
Luckily AS3/Flex has the URLRequestHeader component, which works quite well.

To get the cookie from AS3:

1
2
3
4
5
6

public var cookieStr:String;
public var cookieHeader:URLRequestHeader;
...
ExternalInterface.call('eval','window.cookieStr = function () {return document.cookie};')
cookieStr = ExternalInterface.call('cookieStr');
cookieHeader = new URLRequestHeader("Cookie",cookieStr);

Then when you’re using your URLRequest object:

1
2
3

var urlRequest:URLRequest;
urlRequest = new URLRequest(... blah blah, url here, etc etc);
urlRequest.requestHeaders.push(cookieHeader);

Hope this helps somebody

By: dofus

dofus — Sat, 30 May 2009 05:26:28 +0000

thanks ^^

By: sohpet

sohpet — Mon, 06 Apr 2009 05:16:02 +0000

Thanks