Re: Cross site authentication

Could this be solved by including a physical config file on the server with allowed IP addresses or keys of some sort? (I'm not sure how much control you have over both boxes.) Rick On Wednesday, September 19, 2001, at 10:59 AM, Bill Lubanovic wrote:

"Hoover, Josh" wrote: What about if your XML-RPC calls are run over SSL? That would make them secure I believe. Now the question becomes whether any of the PHP XML-RPC classes support SSL. Anyone know if any/all of the classes support SSL? Josh Hoover KnowledgeStorm, Inc. jhoover@knowledgestorm.com Searching for a new IT solution for your company? Need to improve your product marketing? Visit KnowledgeStorm at www.knowledgestorm.com to learn how we can simplify the process for you. KnowledgeStorm - Your IT Search Starts Here

XML-RPC or SOAP structure the data better than GET or POST, but they

don't address the security issues. We can't send names, passwords,

or

ids, no matter how we wrap them. How can platform A tell platform

B

that it's authenticated someone? How can B trust A?

SSL avoids the problem of someone sniffing the plain text data. We still have the problem: what data do we send? Anyone can forge credentials and send them over SSL. How does B know it came from A? I'm thinking of some key exchange method, but portability between the Microsoft and UNIX worlds makes this even trickier. -- Bill Lubanovic Mad Scheme Limited -- PHP Database Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-db-unsubscribe@lists.php.net For additional commands, e-mail: php-db-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net