Blocking .xml files from being visable in web dubugger programs ie: Fiddler

[MattPohl]

I am curious if there is any way to block the visibility of .xml files when tracking web traffic in programs such as Fiddler. Attached is a screen shot showing the situation. For instance, I can see the config.xml file for my application in Fiddler which can than be opened. Once opened, the tokens used to pass the secure services through the FlexViewer become visible. I am not using a reverse proxy setup, but not sure if that would resolve the issue. Any thoughts would be greatly appreciated.

Matt

[TimDine]

Fiddler can accept regular expressions in it's filter tab.  Check the "Show only if URL contains" check box.  Enter an expression like "REGEX:(?insx).*[^(css|png|xml)]$" in the text box without quotes. This expression would hide css, png, and xml files. 

http://fiddler2.com/documentation/KnowledgeBase/Filters

[MattPohl]

Tim-

Thanks for your response. Yes, this would block those types of files from being displayed in Fiddler for computers I have access to, but not client computers. My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

~Matt

[BjornSvensson · Accepted solution]

My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

That's not possible.  If the "application" can see it, then Fiddler etc can see it.

[MattPohl]

Thanks Bjorn, this was my assumption but thought I would ask anyway.

~Matt

[GISDev1]

Tim-

Thanks for your response. Yes, this would block those types of files from being displayed in Fiddler for computers I have access to, but not client computers. My goal would be to block the visability of .xml files from everybody thus keeping the tokens truly secure from everyone who had access to the application.

~Matt

You know the client being able to see the Token in the config is no big deal right? The token is tied to either the Referrer IP or the Referrer URL. If an attacker has access to use either of those as a proxy to your ArcGIS Server box, you have a more serious problem on your hands.

Of course you can "hide" the tokens and not even use them in the config by hard-coding them in the source code which gets compiled into the index.swf. (The .swf can certainly be decompiled by the way).

This won't really matter because the token will be seen going over the wire anyways. And like mentioned before, this token is no big deal.