Oh yeah, i found it. in the file:
mx.messaging.channels::DirectHTTPChannel.as at line 174: override protected function internalSend(msgResp:MessageResponder):void { var httpMsgResp:DirectHTTPMessageResponder = DirectHTTPMessageResponder(msgResp); var urlRequest:URLRequest; try { urlRequest = createURLRequest(httpMsgResp.message); // for some really strange reason, in THIS scope, the urlRequest object does not compile // if you try to access the manageCookies property. Even in the FB IDE, it does not show // that property available. HOWEVER; if you debug, the object DOES contain that property. // so I am casting down to an object which is dynamic, accessing the property, setting it to // false, which causes the flash player to NOT override the cookies and VIOLA!!! // Cookie enabled HTTPService calls. (urlRequest as Object).manageCookies = false; // end modification } catch(e: MessageSerializationError) { httpMsgResp.agent.fault(e.fault, httpMsgResp.message); return; } var urlLoader:URLLoader = httpMsgResp.urlLoader; urlLoader.addEventListener(ErrorEvent.ERROR, httpMsgResp.errorHandler); urlLoader.addEventListener(IOErrorEvent.IO_ERROR, httpMsgResp.errorHandler); urlLoader.addEventListener(SecurityErrorEvent.SECURITY_ERROR, httpMsgResp.securityErrorHandler); urlLoader.addEventListener(Event.COMPLETE, httpMsgResp.completeHandler); urlLoader.addEventListener(HTTPStatusEvent.HTTP_STATUS, httpMsgResp.httpStatusHandler); urlLoader.load(urlRequest); } I have tested it, using the following method: import mx.rpc.http.HTTPService; public class DebuggablePHPService extends EventDispatcher { public function DebuggablePHPService(target:IEventDispatcher=null) { super(target); } protected function configureZendServiceDebugCookies(service:HTTPService):void { service.headers = { Cookie: 'start_debug=1' + ';' + 'debug_fastfile=1' + ';' + 'ZendDebuggerCookie=192.168.2.3:10137:0||084|77742D65|88432508' + ';' + // 'debug_stop=1' + ';' + 'debug_coverage=1' + ';' + 'use_remote=1' + ';' + 'send_sess_end=1' + ';' + 'debug_session_id=27333395' + ';' + 'debug_start_session=1' + ';' + 'debug_port=10137' + ';' + 'send_debug_header=1' + ';' + 'debug_jit=1' + ';' + 'original_url='+ service.url + ';' + 'debug_host=192.168.2.3,127.0.0.1' }; } I am using zend server community edition, and this works perfectly, causing my Zend IDE to launch in debug mode and stop at breakpoints in my php services. Now I can work on extracting the session from the response to the httpService when i login and then i can come up with a way to create a static "session" that some extended HTTPSessionService can use to maintain a header based session with a server after an initial login. Of course now I am compiling against an Adobe flex 4.6 sdk with the rpc.swc file removed in the compile config, and linking against a custom project made up of the rpc/src folder with the version.as files removed since a generic flex lib project complained about the file and didn't want to compile the lib... (I really just hacked it apart to get to the solution finding asap - i'm sure there were cleaner ways to modify the sdk). I'd really like to try against the Apache Flex SDK, but frankly i'm in a 1 month rush development and don't have much time for experimenting (other than this session service layer which is critical). Cheers Everyone! Dave