What's the best way to save user login and password in flex?

What's the best way to save user credentials in flex? Local storage doesn开发者_JS百科't seem like good place for storing confidential data, because it saves information as a plain text.

You shouldn't. Use browser cookies or a session token to identify the user to the server. For instance:

1. User enters username and password into a form in Flex and clicks login.
2. Server validates credentials. Then either in memory or in a database the server associates a random (and sufficiently secure) token with the user. Then the server returns the token to the client.
3. Client saves the token in either a cookie, LocalSharedObject, or just in memory. Then subsequent requests also include the token.

You can use ExternalInterface to communicate with JavaScript and store data in browser cookies.

Don't store users' name or password in cookies - create a session in the server with credentials in it, and store the session id in the browser cookies.

if your service don't support credential, then the only think you can do is save user login state in SharedObject.

You can save hash value of UserName + Random Token to SharedObject and save a copy of UserName too in SharedObject, then when application created creationComplete check wheather the hash value match with the saved user name.

the good thing about this trick is:

1. Password never persisted locally.
2. Harder to fake login because need to match username with the hash value.

a bit hard to explain here you can check it here, source code is available for download.

User credentials are normally stored in a session variable.

You don't necessarily need to save the credentials as plain text in Local Storage; in fact, Local Storage (SharedObject) is actually serialized as AMF, so it's not plain text to begin with. Whatever medium you use to store your sensitive data, you should certainly consider using some sort of hashing or encryption techniques like SHA1 or RSA.

The difference between hashing and encryption is this:

• Hashing (SHA1, MD5, etc) is a one-way encryption - in other words, it's very difficult to determine the original value of the hashed value, so what you can do is compare one hashed value to another since these hashing algorithms will always spit out the same thing.
• Encryption (RSA, AES, etc) is a two-way encryption - in other words, you can determine the original value of the encrypted data, usually by using a public/private key combination

It really depends on what you're trying to do.

Hope you come right

SharedObject is a very bad place to store your password in.

Please see this:

http://livedocs.adobe.com/flex/3/html/help.html?content=security2_22.html