How do i know if the request came from flash swf?

Question

I have an application developed in flash, and I need to access some php files. so the php file return some data if the access is came from swf. How can i identify if the request came from flash or not?

without passing get/post variables to php.

Answer 1

User agent/Referer possibly. Keep in mind that requests can easily be forged

Answer 2

This is in response to John Ballinger's answer:

import flash.net.URLLoader;
import flash.net.URLRequest;
import flash.net.URLRequestHeader;

var loader:URLLoader = new URLLoader();
var request:URLRequest = new URLRequest("http://www.mydomain.com/myapp.php");
var header:URLRequestHeader = new URLRequestHeader("custom-header-name", "value");
request.requestHeaders.push(header);
try {
    loader.load(request);
} catch (error:Error) {
    trace("Unable to load requested document.");
}

You must also make sure to modify your crossdomain.xml to allow http headers as follows:

<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*.mydomain.com" />
    <allow-http-request-headers-from domain="*.mydomain.com" headers="*" />
</cross-domain-policy>

Answer 3

I don't think there really is a reliable way of detecting whether Flash made the request. Flash doesn't allow you to set the user-agent, and there are a lot of restrictions on what headers can be set.

Take a look at http://help.adobe.com/en_US/AS3LCR/Flash_10.0/flash/net/URLRequestHeader.html

as John Ballinger suggested, you could set your own header using this and look for that header in the PHP page.

Answer 4

You cannot tell that it is coming from flash as flash actually uses the browser to do the request.

But in your flash request you could add your own header to the HTTP request (you can do this pretty easily in flash). That way you can see if the request is coming from Flash.