A security constraint defines the security restrictions on a BlazeDS destination. However, you can also use BlazeDS as a proxy to a remote HTTP service or web service.

If the remote HTTP service or web service requires credentials to control access, use the setRemoteCredentials() method to pass the credentials. For example, when using an HTTPService component, you can pass credentials to a secured JSP page. Passing remote credentials is distinct from passing credentials to satisfy a security constraint that you defined on the destination. However, you can use the two types of credentials in combination. The credentials are sent to the destination in message headers.

You can also call the setRemoteCredentials() method for Remoting Service destinations managed by an external service that requires user name and password authentication, such as a ColdFusion Component (CFC).

The following example shows ActionScript code for sending remote user name and remote password values to a destination. The destination configuration passes these credentials to the actual JSP page that requires them.

var employeeHTTP:mx.rpc.http.HTTPService = new HTTPService();
employeeHTTP.destination = "secureJSP";
employeeHTTP.setRemoteCredentials("myRemoteUserName", "myRemotePassword");
employeeHTTP.send({param1: 'foo'});

As an alternative to setting remote credentials on a client at run time, you can set remote credentials in remote-username and remote-password elements in the properties section of a server-side destination definition. The following example shows a destination that specifies these properties:

<destination id="samplesProxy">
    <channels>
        <channel ref="samples-amf"/>
    </channels>
    <properties>
        <url>
            http://someserver/SecureService.jsp
        </url>
        <remote-username>johndoe</remote-username>
        <remote-password>opensaysme</remote-password>
    </properties>
</destination>