Pearson request for help with Flex AMF issue

[kharbour]

As a supplier of many services and products to UK schools, we are currently researching the best solution for communication from our new range of Web applications with our back end servers, to ensure we provide schools (both primary and secondary) with the best user experience. Many of our new products will be Rich Internet Applications developed using Adobe Flex. We are considering using AMF (Action Message Format) for communication with our backend servers. This is for two main reasons - the elegant programming model AMF allows on both the server and the client, and the high performance benefits that accrue from the binary data nature of AMF.

 

When using AMF, binary data is sent over HTTP from the Flash player inside the user's browser to our servers on port 80. This is obviously different to the normal case with browser traffic, where binary data may be returned (Flash movies for example), but outgoing traffic is text-based.

 

One would not necessarily expect outgoing binary traffic to be a problem on the Internet. However, in the (UK) schools market, firewalls, proxies and web security software such as Websense obviously become factors in the network environment.

 

We are concerned that there is potential for AMF traffic to be blocked by the various security technologies in use in UK schools.

 

We know it is possible to address any such issues on a case-by-case basis with each local authority, but this is not something that we want to burden LA network admins with if it can be avoided.

 

For this reason, we have developed a small test harness to test whether AMF traffic really will be blocked in UK schools.

 

We are posting this message here to request that people access our test client, from within their LA/school network, and click on each of the two buttons and post the results here. The reason that there are two buttons is that we are considering using JSON, a purely text-based format, as an alternative to AMF.

 

The test client is available here:

 

http://demo.prg.pearson.com/nettest.html

 

We would also like to test the behaviour of our test client when accessed over https, here:

 

https://demo.prg.pearson.com/nettest.html

 

as this is a test, we have not set up a commercial SSL certificate for this site, so unfortunately the https URL will cause your browser to raise a certificate warning - please ignore this. We will not be asking you to send us any sensitive data.

 

If you could reply to this post with what you get in Box 1 in each of the four cases (i.e. HTTP/JSON, HTTP/AMF, HTTPS/JSON, HTTPS/AMF), it would be very much appreciated.

 

Thanks in advance.

 

Edit: Having seen a few replies already (thanks very much for those), it would be useful if you could also give any information about what filtering / firewall / security software you are using.

Edited March 23, 2010 by kharbour
Asking for more info

[powdarrmonkey]

Please, please for the love of the monkeyfish use plain text JSON in an HTTPS tunnel. It will save us so many headaches, not only intercepting and filtering but debugging too.

[elsiegee40]

Top row http:

Bottom row https:

 

Filtering through RM SafetyNet Plus

[ahuxham]

HTTP:

 

1) JSON 40319

2) 200

 

1) AMF 40336

2) 300

 

HTTPS:

 

1) JSON 40367

2) 200

 

1) AMF 40378

20 300

[linkazoid]

Smoothwall School Guardian

 

HTTP:

JSON 3704 - 200

AMF 7208 - 300

 

HTTPS:

JSON 4419 - 200

AMF 3500 - 300

[notalot]

Filtered threw EMBC

 

Http

 

1) JSON 45723

2) 200

 

1) AMF 40101

2) 300

 

Https

 

1) JSON 49239

2) 200

 

1) AMF 42501

2) 300