Security issues in the connection between the flex client and property provider

[CathyBr]

Hi,

I probably should know this, but the customer is worried about a security issue.  I don't think

that it is a problem, but its better to ask and be sure.

In my flex client, I have a dialog where a user can enter a password.  I then take the password

and send it to my property provider.  This password is normal text, I do nothing to encode it before sending

it over.  Is this ok? I think that the connection is secure, but please confirm this, or should I encode it before sending?

Thanks for the info

Cathy

[laurentsd · Accepted solution]

Yes, the Data Manager API uses the secure AMF channel.  Likewise if your plugin is calling a custom java service you should use "/.../messagebroker/amfsecure" for the proxy channel URI as shown in the SDK samples.

[CathyBr]

Many thanks Laurent,

I thought so, but was just checking.  No I send the password to the vCenter, using HostSystem.updateIPMI(), so that goes over a soap connection, and must be ok as well.  Am I right?

Cathy

[laurentsd]

I can't say since I don't know your setup.  You are responsible for ensuring the security of your communications between your java component running on the Web Client server and any back-end.