The second chapter describes what the request parameters, mainly public parameters and business parameters, the server needs to validate the parameters, the validity of the request parameters have been verified
before the parameteris tested, the following parameters are explained: 1, Parameter key value pairs: including public parameters, business parameters 1, Public parameters: Key value of the string, such as Time=123123app_id=sdf34234method=user.buyer.get 2, System parameters: 1, if a GET request is added to the public parameter after 2, if it is a POST request, you need to get the server from the form
2, internal key: The secret key agreed by both parties, generally APP_SECRET3, sign: Key value pair + internal key for MD5 encrypted string
Server Side How to verify security 1, to determine whether the timestamp is reused (if the parameter contains the use of (the same app_id, method) of time stamp, then directly deny) 2, determine whether sign matches (sign is the key value pair + internal key after the MD5 string, Because the internal key only the client/server know, so it is not easy to crack, plus the time stamp to judge the weight, so the same URL connection can not be reused )
MD5 Encrypted Web site: http://md5jiami.51240.com/
From for notes (Wiz)
Design the SOA framework from scratch (iii): How to Encrypt request parameters
