Securing XOBJ

Inter-linkset only projects

If you don't need your project to communicate outside of the linkset itself, simply don't add initiateListen() to your #ROOT script.

Owner only external communication

If your project needs to communicate with other linksets, but only linksets of the same owner, add this definition before the #include "xobj_core/_LISTEN.lsl":

#define LISTEN_LIMIT_FREETEXT idOwnerCheck

LISTEN_LIMIT_FREETEXT injects code at the top of the listen event. idOwnerCheck will prevent events received if the sender is not the owner or owned by the same owner of the script.

Shared communication with tokens

XOBJ lets you use a simple token to check if a request is proper. It uses a simple function which generates a 16 character hash to be validated. To use the built in hashing, add these to your _core.lsl file before any includes:

// Replace  with a random integer
#define PC_SALT 
// Replace myTokenSalt with a password for your project
#define TOKEN_SALT "myTokenSalt"

• PC_SALT is used to generate the personal channel each agent gets when using XOBJ.
• TOKEN_SALT is used to improve the security of the validation token each listen request gets.

If you don't want to use the tokens (make sure you check the owner within #define LISTEN_LIMIT_FREETEXT before accepting a method call) you can use #define DISREGARD_TOKEN

If you want to write your own token algorithm, use #define OVERRIDE_TOKEN and then add your own string getToken() function to your _core.lsl file.