Application Security - Protecting the files from direct access

Question

I am working on my application. I have a Flex app that
everyone will access but to do the work, I have it calling on
several PHP files. The Flex app has a login system and only allows
advanced functionality after login. This protects the Flex portion,
but does not really account for the PHP side of things.... The PHP
files do a variety of things, mostly SQL calls, but also run a few
system commands.
How do you set up the PHP files or use an htaccess file to
only allow the Flex app to call the PHP files? I'd like to set it
up so that the users can't directly access the PHP files. However,
I'm sure the client workstation is still making the request when
called by the Flex app, right?
Has anyone done this? Does anyone have any thoughts or
suggestions on this?
Thanks,
Chris

Answer 1

Hi csawall,
These are just some off the top ideas, you can extrapolate
and create a solution that might work:
Since the client has access to the data stream to/from the
server, there is no way to guarantee that someone won't use some
kind of sniffer program to find what file the flex app is talking
to, but that doesn't mean that you can't obfuscate it as much as
possible to make it not worth trying.
One idea was to use a single index and use _GET to control
what content is being served, using includes on the php side to
serve the proper file/content.
Since the content you are delivering I would assume requires
authentication, you'll have a unique session ID to work in. While
the actual php file could be accessed in real time if you watched
the data stream, if the user is already authenticated, what diff
does it make? Set up specific rules inside your php file, so that
it must receive data using a specific protocol, one that you can
obfuscate using crypt and base it on variables that are unique,
such as SSID + date + time, etc. When you first authenticate with
the server from the flex app, have the php login script return the
required protocol rules back to the flex app that would be unique
to the session. The _SESSION variables on the server would contain
the unique protocol rules as well. This gives you server side
control over talking to the flex app... then all you would need to
do, if you wanted to keep a tighter lid on the access to your
script, is just rotate the protocol from time to time.
Add on top of this, script name obfuscation that you store
server side and transfer only withing the validated session, such
as e.g. fstrs4adadst4_somefile.php etc etc, where your randomized
key is the prefix (or suffix whichever you prefer) of your index.
Your code of course would use the current protocol keys to match
the current index, and all you need do is control the .htaccess
file so that it relays any $_somefile.php to the proper
file/directory etc which would be a name that would never be
revealed to the public, and only used inside your .htaccess file or
on the server side itself.
Taking it a step further, if you create some kind of pulsing
authentication system using the above methods, you can rotate the
keys fast enough, so that someone would have to work really hard to
figure out the protocol to talk to your server
Just my 2 cents...
RFX