title: Security for Flex app when ssl is not available
body: <p>So I know the best practice would be to run my Flex app over ssl along with implementing other forms of security however that isn't an option at this point (for monetary reasons and the app simply doesn't <em>need</em> that much security otherwise my sponsors would pay for it).  However, I would like to implement some form of security and I'm wondering whether it's even worth it when I don't have ssl to protect the transactions. </p>
  
  <p>So my setup is that I have a ASP.Net server side with a Flex UI. Right now the UI is the only thing that protects access to the sever: the server doesn't do any sort of verification during each request, it just assumes the person is allowed to do it.  Obviously, anybody could write a program to generate posts (even if I could use SSL it would be like swiss cheese).  Like I said before, security isn't a big deal, this is an internal app and it's nothing critical, however I do believe in doing things right.  Would keeping the user info in session be a viable option and then verifying that the given user has permission, etc.  Perhaps some sort of token system?</p>
  
  <p>What would your preferred method of protecting this setup be?</p>
  
  <p>...and no, I won't give you the url :)</p>