Justtechjobs.com Find a programming school near you






Online Campus Both


php-general | 2001092

[PHP] Re: [PHP-DB] Cross site authentication From: Bill Lubanovic (bill <email protected>)
Date: 09/19/01

> "Hoover, Josh" wrote:
>
> What about if your XML-RPC calls are run over SSL? That would make
> them secure I believe. Now the question becomes whether any of the
> PHP XML-RPC classes support SSL. Anyone know if any/all of the
> classes support SSL?
>
> Josh Hoover
> KnowledgeStorm, Inc.
> jhoover <email protected>
>
> Searching for a new IT solution for your company? Need to improve your
> product marketing?
> Visit KnowledgeStorm at www.knowledgestorm.com to learn how we can
> simplify the process for you.
> KnowledgeStorm - Your IT Search Starts Here
>
> > XML-RPC or SOAP structure the data better than GET or POST, but they
>
> > don't address the security issues. We can't send names, passwords,
> or
> > ids, no matter how we wrap them. How can platform A tell platform
> B
> > that it's authenticated someone? How can B trust A?

SSL avoids the problem of someone sniffing the plain text data. We
still have the problem: what data do we send? Anyone can forge
credentials and send them over SSL. How does B know it came from A? I'm
thinking of some key exchange method, but portability between the
Microsoft and UNIX worlds makes this even trickier. 

-- 
Bill Lubanovic
Mad Scheme Limited

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: php-general-unsubscribe <email protected>
For additional commands, e-mail: php-general-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>