I've been playing around with remoting for a while. Now that I've actually started a serious project with it, I've run into something important: How can you implement the shared object so that only the server can trigger certain events?
suppose:
// ...
public delegate void AdminTriggeredEvent(/* .... */ );
public interface IWellKnownInterface
{
/*
....
*/
event AdminTriggeredEvent AdminEvent;
};
Without, for example, using a public / private key encryption to verify the sender of every event (which would be very inefficient), any client could trigger this event.
Thoughts?
Add a parameter with a password or something, and asset false if it's incorrect.
I don't see how that would work. A client could simply copy the password from a previous server event. Besides, I was looking more at some sort of encapsulation or hiding technique, since using a password or encryption scheme would just be wasteful.
Quote from: K on November 09, 2003, 04:46 PM
I don't see how that would work. A client could simply copy the password from a previous server event. Besides, I was looking more at some sort of encapsulation or hiding technique, since using a password or encryption scheme would just be wasteful.
I don't know if there is a 100% secure solution to this. A malicious client will always be able to break past nearly any security with the right amount of time and effort.
Right, but in this case the time and effort required would simply be one function call.
So what you're saying is you want to use a friend class?
I'm not sure what you mean by that. The server and client share an instance of an object that implements the IWellKnownInterface (in this case) and inherits from MarshalByRefObject. There is no friend class -- they're the same class.