Security and authentication

Question

The bottom line is I don't know anything about either of
these two areas. I've always been a client side interactive
developer and designer, handing off the real backend work to
developers in that field. FMS is finally plunging me into this
area, as now I can apply my knowledge of ActionScript to the server
side of things, and pull together some amazing stuff.
How should I authenticate, say, a basic chat, so only logged
in users can send a message? I can easily require login on the
clientside, but that wouldn't stop spoofing and decompiling. Is the
FMS communication encrypted? I could send username/password for
each message based on the client input, and authenticat securly on
the server against a serverside list, but that seems rather foolish
in the event someone listens in on the clients messages, they would
then see the username and password. But how else would it be
done?

Answer 1

FMS can use SSL just like an https server can, but it's not
configured by default. You'd need to set up a certificate and
configure FMS to use SSL. That said, unless you need to encrypt the
chat (or other data/audio/video), you don't need to secure your FMS
Really, all you need to to is authenticate once when the user
connects. Here's what I like to do:
1. Have the user log in via https (before connecting to the
FMS app)
2. Have the http side login process create a token (I like to
use a random 50 character string) and store it in a database
3. Pass the token back to the client in the response to the
authentication request
4. Connect to FMS, passing the token in the
netconnection.connect arguments
5. Before accepting the client, the FMS app calls back to the
http server (using loadvars, netservices, or an xml object),
sending the token in the request
6 The http service checks the ticket, and returns a success
or failure message. If the ticket is good, the service expires or
deletes it so it can't be used again.
7. The FMS app accepts/rejects the client based on the
response from the token authentication request.
So, the only time a password gets transmitted is when the
client first logs in. That makes it easy to encrypt the sensitive
data, and then just send the token (unencrypted) to the FMS server.
Even if someone intercepts the token, it will be of no use to them,
as it can only be used once.