Section 18.5. Suggestions and References

18.5. Suggestions and References

Security is a large subject that has only been touched upon here. Setting up and hardening a FlashCom Server are an important part of providing secure applications, but outside the scope of this chapter. You should make sure that whoever is hosting your applications has worked through Macromedia's security recommendations and hardened their servers. Pay special attention to whether a referrer check has been put in place; if not, you need to code one in every application.

The following list of references should be consulted as needed to help you administer or secure FlashCom and FlashCom applications:

• The CERT Coordination Center (CERT/CC) is a center of Internet security expertise, located at the Software Engineering Institute at Carnegie Mellon:

http://www.cert.org

• The full Macromedia Flash Communication Server MX documentation is available online. Be sure to read Managing Flash Communication Server especially the section on Configuring Flash Communication Server:

http://www.macromedia.com/support/flashcom/documentation.html

• David Simmons provides a FlashCom security overview at:

http://www.macromedia.com/devnet/mx/flashcom/articles/security_overview.html

• Mike Chambers' security white paper (PDF; 496 KB) is also good background reading:

http://www.macromedia.com/devnet/mx/flash/whitepapers/security.pdf

• TechNote 16631: HTTP Tunneling Protocols:

http://www.macromedia.com/support/flashcom/ts/documents/http_tunneling.htm

• Macromedia Flash Communication Server MX 1.5 Release Notes:

http://www.macromedia.com/support/flashcom/releasenotes/mx/rn_mx_15.html

• TechNote 16448: Securing Macromedia Flash Communication Server:

http://www.macromedia.com/support/flashcom/ts/documents/securing_flashcom.htm

• TechNote 18537: Updates to the SimpleConnect component:

http://www.macromedia.com/support/flashcom/ts/documents/simpleconnect_update.htm

• Stunnel , a universal SSL wrapper that allows you to encrypt arbitrary TCP connections inside SSL:

http://www.stunnel.org

• The OpenSSL project:

http://www.openssl.org

• The SSL 3.0 specification:

http://wp.netscape.com/eng/ssl3

• Branden Hall's Flash security article:

http://www.macromedia.com/desdev/mx/flash/extreme/extreme003.html

• Paul Johnston's JavaScript SHA1 and MD5 code:

http://pajhome.org.uk/crypt/md5/index.html

• The BSD license:

http://www.opensource.org/licenses/bsd-license.php

• Macromedia's security zone:

http://www.macromedia.com/v1/developer/securityzone

• Macromedia's Des/Dev security page:

http://www.macromedia.com/desdev/security

• Tunneling Macromedia Flash Communications through firewalls and proxy servers:

http://www.macromedia.com/devnet/mx/flashcom/articles/firewalls_proxy.html

• PPP Challenge Handshake Authentication Protocol (CHAP), RFC 1994:

http://www.ietf.org/rfc/rfc1994.txt?number=1994

• FlashCom logging:

http://www.macromedia.com/support/flashcom/ts/documents/flashcom_logging.htm

• Flogger 1.1 is available at:

http://www.markme.com/mesh/archives/000774.cfm