Need to make actionscript POST data over https

Question

I have an application that was recently given an AWS certificate (and put in an ELB - classic I think).

The web application has a Flash movie that makes web calls (to same site URL) in order to fetch data using Zend Framework 1 models. The page in browser does not change. When I request the site over https, all of the imported items have been changed over to https protocol, but when the Flash movie initializes, it makes non-secure requests over http.

It makes these non-secure requests when I load the site over http, or https.

The reason I mentioned the AWS ELB is because I was told that the ELB is doing some kind of redirect to port 80.

If I request the site over https, and immediately do print_r on $_SERVER array I am only seeing HTTPS as a REDIRECT key, and not seeing $_SERVER['HTTPS'] set, which I think is important.

In summary, the Flash movie, inside a Zend 1.12 site, is making POST requests over http, and I'd like it to make the same requests, but over https.

It is a very old Flash movie, and although I've opened the swf file with a decompiler, I do not know much about actionscript to see where (in the many code files) I'd be able to instruct the movie to call https instead of http.

My theory is that when the site is properly running as SSL/https that the flash movie may ?possibly? start making https calls since at the moment is "is" using the address bar URL, but there also could be that ELB redirect stuff happening that's gumming it up as well.

Update: I found (what appears to be) evidence that if https is detected in the URL it's given, that it will then make secure requests...

FILE: mx.rpc.remoting.RemoteObject

mx_internal function initEndpoint() : void
  {
     var chan:Channel = null;
     if(endpoint != null)
     {
        if(endpoint.indexOf("https") == 0)
        {
           chan = new SecureAMFChannel(null,endpoint);
        }
        else
        {
           chan = new AMFChannel(null,endpoint);
        }
        channelSet = new ChannelSet();
        channelSet.addChannel(chan);
     }
  }

Thanks, Adam

Answer 1

I was able to restore the original/old unedited Flash SWF File, and instead modified the PHP Code that passes in a variable and value called "endpoint".

In the code sample I provided, it checks if endpoint has https in it (which I initially thought that it did).

I added code to modify the value of "endpoint" when HTTP_X_FORWARDED_PROTO was "https", sample below: (the $request->getBaseUrl() is from Zend Framework).

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    $endpoint  = sprintf(
        '%s://%s%s',
        $_SERVER['HTTP_X_FORWARDED_PROTO'],
        $_SERVER['HTTP_HOST'],
        $request->getBaseUrl()
    );
} else {
       // use existing (and working) value for endpoint
}

With that code in place, the FLASH movie loads in, and operates properly whether site is loaded with http or with https