[Plugin] ajaxPost

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   hi,
because the Ajax-post-Plugin isn't available i've created a new one (based on the AJAX-Plugin).

Usage like AJAX-Plugin with the difference that you can post the data via POST.   

Plugin ajaxPost
postExample.capx (HTML-Div Plugin for the example)
ajaxexamplePostData.php
All suggestions are welcome.   

Joe7

Edited by Joe7 - 10 Feb 2012 at 5:07pm

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
Joe7 2,772 Rep 2 4 11	Post Options Post Reply Quote Joe7 Report Post Quote Reply Topic: [Plugin] ajaxPost Posted: 10 Feb 2012 at 5:06pm
	hi, because the Ajax-post-Plugin isn't available i've created a new one (based on the AJAX-Plugin). Usage like AJAX-Plugin with the difference that you can post the data via POST. Plugin ajaxPost postExample.capx (HTML-Div Plugin for the example) ajaxexamplePostData.php All suggestions are welcome. Joe7 Edited by Joe7 - 10 Feb 2012 at 5:07pm

Schoening 5,805 Rep 1 8 32	Post Options Post Reply Quote Schoening Report Post Quote Reply Posted: 10 Feb 2012 at 6:04pm
	Probably nice Ajax is still over my head ^^

edisone 9,205 Rep 8 17 55	Post Options Post Reply Quote edisone Report Post Quote Reply Posted: 10 Feb 2012 at 6:18pm
	tnx a lot Joe7 ^^

Index 4,275 Rep 2 5 51	Post Options Post Reply Quote Index Report Post Quote Reply Posted: 15 Feb 2012 at 2:20am
	Worked. Thanks. I can finally get a login system working.

Kinny 379 Rep 1	Post Options Post Reply Quote Kinny Report Post Quote Reply Posted: 20 Feb 2012 at 7:39pm
	That's a very great plugins! I was looking for this one! Does anyone know how to encrypt or protect the post data values sent from the c2 game to server? Thank you!

Joe7 2,772 Rep 2 4 11	Post Options Post Reply Quote Joe7 Report Post Quote Reply Posted: 21 Feb 2012 at 10:32am
	Propably with the CB Hash (MD5, SHA-1 and SHA-256)-Plugin.

Weishaupt 8,539 Rep 6 10 28	Post Options Post Reply Quote Weishaupt Report Post Quote Reply Posted: 21 Feb 2012 at 11:02am
	I allways thought, that HASH is a one-way thing..?!?
	_____________________ You want help? Post your CAPX! virtus junxit mors non separabit

Joe7 2,772 Rep 2 4 11	Post Options Post Reply Quote Joe7 Report Post Quote Reply Posted: 22 Feb 2012 at 8:51am
	Yes, it should be. As I understand the question - he asked only the encryption - e.g. post the "username"+"password" and store this encrypted string on the server. The username and the score can send without encryption to store on the server. The client that uses the C2 game knows who he is ("username") and the app calculates the "score". Second login: C2 encrypts username+passwort again --> send it to the server --> server: compares this string to the string stored before --> message success/fail to c2-client that wants to play Suggestion: If sending the username and the score unencrypted is to unsecure for you (-you can see the real-characters eg with wireshark ) - why not merge it in the encrypted string: When the encrypted string for the user "Joe7"+"joelspassword" is --- "0123456789abcdef" ---- and the score is "20" --> merge it in: --- 01234567Joe789ab2cd0ef --- and post this string. If you know the right positions of the characters you can pick them out Edited by Joe7 - 22 Feb 2012 at 8:55am

Kyatric Moderator 28,562 Rep 17 32 96	Post Options Post Reply Quote Kyatric Report Post Quote Reply Posted: 22 Feb 2012 at 11:37am
	Actually, encrypted or not, just sending credentials like that is a possible security hole. Another way to secure things is to go through https protocol (the page that does the ajax request is already a secured page, and the destination adress for the request is an https:// adress too). This should help preventing the credential from falling into unwanted/malicious hands hopefully.
	New to Construct ? Where to start - how do I FAQ Pro tips for Scirra's forums

Kinny 379 Rep 1	Post Options Post Reply Quote Kinny Report Post Quote Reply Posted: 24 Feb 2012 at 1:56pm
	Thank you Joe7 and Kyatric for your answer! :) Yes, I thought about mixing your 2 solutions (CB hash & https) because I'm looking the way to protect the username, hash session of player and score. But I'm still care about the fact the player (called hacker) could find a way to make some ajax call from javascript console (like firebug or chrome console or anothers tools) by finding my C2 javascript function (even minified) to make the same CB Hash and call it to send a high score to server manually... Just like EdgeWorld's game, there are some tools to hack that game even if EdgeWorld is in https mode... :( I'm not expert and don't know very well https, but I saw that every JS Client application use that way even if post data is not encrypted (just like iCloud.com do) Do you think https could prevent that kind of attack?