Take the 2-minute tour ×

I am developing a flex 4.5 web based application and I need to make sure if the client chooses a certain level of security, each user can log only from an authorized computer.

So the question is how can I get some unique computer information? Anything like HDD serial number, CPU specifications, motherboard information, even the user that is logged into the Operating System can do.

So far the information on the web isn't giving me much hope that this can be achieved, but I had to ask. Thanks in advance.

share|improve this question
add comment

5 Answers

up vote 1 down vote accepted

This is not easy using a browser based Flex application, but there are some workarounds.

The browser based Flash Player can communicate with an AIR app on the desktop using localconnection. So, you could create an AIR app that utilizes NativeProcess to retrieve your machine specific information.

You could also use NativeProcess from a AIR app without using the browser at all.

A third option would be to install an application server on the client machine and have the browser based app communicate with the server to retrieve the client information.

I consider most of these options too difficult to be practical, but it depends on how important this feature is to you.

share|improve this answer
I was already considering the using a Java desktop app to achieve my goal. It never occured to me that I can use an AIR application and thanks for the suggestion since using an AIR app would imporve the user experience(UI consistency). I was also hoping for an easier solution when I asked my question since downloading and installing of unnecessary desktop apps is such an annoying task. Thank you an have a nice day. –  Nikola Kolev Aug 31 '11 at 17:19
add comment

I suppose the only option available for web application is to create unique id from fields of flash.system.Capabilities class.

Other strategy which can be used is to generate unique UID in process of computer's authorization and then store it in local storage using SharedObject. Then web app tries to read authorization data from SharedObject on web app start. If there is no such data computer isn't authorized.

share|improve this answer
+1 I liek this one. –  Mark Lapasa Aug 29 '11 at 22:54
Hmm maybe there is something I don't understand, but how can I make the generated UID unique for every machine? I mean, I am trying to achieve a certain level of security that cannot be bypassed by simply copying the sharedobject file to another machine. –  Nikola Kolev Aug 30 '11 at 6:43
No, this suggestion can't prevent from simple copying shared objects to an other computer. So it can't prevent from hackers. But most of the end users knows nothing about local storage of shared objects. –  Constantiner Aug 30 '11 at 6:48
add comment

Richard is right. For security, unique identifying information is not available for applications running through Flash Player. You could write an Active X control (for IE) or a plugin (for Mozilla based browsers) to obtain additional information for your app if users (and their IT administrators) allow it. Information available will vary depending on the browser and operating system the user is running.

Adobe Air, on the other hand, allows access to additional network information including MAC address in the NetworkInfo class. Maybe it's worth considering an installed client app for users who require the additional security. Take a look at: http://www.adobe.com/devnet/air/flex/articles/retrieving_network_interfaces.html

share|improve this answer
add comment

The Flash Player security sandbox will not let you read anything unique about the system on which the SWF is running, so I'm afraid this is not possible. The closest you will get is likely Capabilities.serverString along with maybe IP address, but the serverString property just lists all the capabilities of the client, which is obviously not a unique thing, and also might change from time to time for the same computer.

share|improve this answer
add comment

Warning: my knowledge of server-side scripting is limited to say the least. This isn't a technical solution, but rather a different approach to your problem.

An alternative solution to would be to inspect the raw packet at the server in order to obtain data such as the IP and MAC address. Based on this the server can then deny or allow the login attempt.

I am used to working on embedded web servers running on micro controllers where C-based black magic is rather common, so I am not sure if this is possible or practical in a more traditional environment.

share|improve this answer
add comment

Your Answer


