Actionscript to PHP Authentication

[atomgiant]

Is there a standard way to "protect" a PHP script from being accessed from others.

For instance, I plan on submitting high scores and such via LoadVars in ActionScript to a PHP script. Here are some of the approaches I am considering:

1) Just use the Php SessionID to enforce that they are logged in.

Potential Problems: Any user that logs in could then call the PHP script and pass whatever they want.

2) Check the referring headers to ensure this script is only being called by an appropriate party.

Potential Problems: I am not sure what headers ActionScript will send... they may be based on the users IP and domain (I will eventually test this... but if anyone knows now how this works... I would appreciate it).

Other ideas:

- weak encryption (i.e. - secret decoder)
- a custom session key that is passed at the start of a game that must be submitted with the score

Any thoughts are welcome and appreciated.

Thanks,
---atomgiant

[abzoid]

Your option 2 should do the trick. Even when sent from AS the HTTP header should still contain the same info as a standard HTML link. But, as you said, do a simple test to be sure.

[atomgiant]

Thanks for your reply.

Just to clarify a bit, the part I am unsure of in my option 2 is whether the headers will say the referrer is from the same domain as where the Flash program was downloaded from (which I would prefer), or if it is from the user domain based on where the user is logged in.

If it is the second, then I will have to find a different approach.