Comments on: OpenSocial: JavaScript Code of Flixster on MySpace – Start Hacking!

By: sandy

sandy — Wed, 27 Aug 2008 10:58:12 +0000

above link for zip file is not working also txt file link not working. can u plz check if possible send by email

thanks

By: Miron C

Miron C — Sun, 04 Nov 2007 18:58:46 +0000

A quick look at the JavaScript code shows that the client-side JavaScript is passing the user ID to the backend without any authentication. This means that it’s trivial to mess up anybody’s Flixter profile.

This seems to be a general issue with OpenSocial. Unlike Facebook, Opensocial seems to be missing user to app authentication. I wrote an article about it:

http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/

I hope that the Facebook version of Flixster does take advantage of
their authentication mechanism.

By: Wal

Wal — Fri, 02 Nov 2007 22:05:48 +0000

I was looking for good examples. Thanks for the tip.

By: Steve Poland

Steve Poland — Fri, 02 Nov 2007 12:53:36 +0000

http://www.myspace.com/aber — CTO, MySpace

By: Matt Smith

Matt Smith — Fri, 02 Nov 2007 03:17:11 +0000

Steve, where did you get these files?

By: kiakanpa

kiakanpa — Thu, 01 Nov 2007 21:01:16 +0000

Quick work will take a look