Desktop Flex application login system

Question

I'm currently in the planning/early building phase of a desktop flex application that will be communicating to a Zend Application on a web server.

The flex app will basically be like a layout/view in terms of the MVC pattern, it will make requests to various controller actions and display the data returned in a meaningful way, and post data that will update various data in the database on the server.

Basically what I'm wondering is what the best way is to go about building a login system for the desktop application. Hopefully I'm correct in assuming that I can't use the regular channels that you would if your users were accessing the application via a browser, so I was thinking I would do this:

1. Flex app posts login details (email, password) to a login action
2. The login action uses Zend Auth to check if the details are valid
3. The login action creates a unique hash (and stores it in the db somewhere along with the user's id) and returns a json object containing the hash along with the user's id to the flex app
4. Whenever the flex app makes requests to any action in the web app, it also sends along the user's id and the unique hash so the web app can verify the user.

Does this make sense, or am I barking up the wrong tree here?

Let me know what you think, and whether there's a better solution I should look into.

Thanks!

Answer 1

Yes it makes sense what you're doing, I have built a similar system but, in this case I use Basic authentication, that way when I send an HTTPService to the server, I include the hash (token) on the header.

I'm using an API that was built by a coworker where he sends me a token when I make a login action.

The header information that I sent looks like this:

myHttpService.headers = {Authorization:"Basic " + encoderString};   

The encoderString variable is made using the username and token that the server returns to me when I am logged, I use these variables to create the encoderString:

var encoder:Base64Encoder = new Base64Encoder();
var encoderString:String;    

encoder.encode(login+":"+token);
encoderString=Basics.encoder.toString();

Answer 2

查看Apache Shiro ，使用安全库确实非常简单，很简单，它需要最少的依赖关系，很少的配置，并且无论您是在构建老式的HTML应用程序，Flex富客户端Web应用程序还是台式机Flex，都不会引起麻烦。 / AIR（甚至是Swing）应用程序。