Questions about WEBAPI Safety certification

Source: Internet
Author: User

Before the project encountered an external provider of API issues, some superficial ideas, the time to record.

The following discussion is all about solving the problem of who is eligible to call this API (who has permission to do this)

To simplify your thinking, take an example of a student viewing Java class.

Xxx/java/stuclass?name=java

1. The simplest is not encryption, such as on the request, this will cause as long as the user who knows the API can send the request, if used by people, the request, waste a lot of resources.

2. After the request is followed by a specific set of annotation characters, the annotation character conforms to the requirement to continue execution. This creates problems with the same 1

Xxx/java/stuclass?name=java&ticket=abedf

3. Encrypt the unique authentication information of the API user (asymmetric and symmetric). This attachment information is sent to the background, the background after receiving decryption, to determine whether the user identity is legitimate.

Xxx/java/stuclass?name=java&ticket=15ff57fger
4.3 The problem is that if a person is maliciously exploited ticket, it will still be requested more than once, so it would be better if the identity information and the valid time information (from the background) are encrypted to send to the background.

Questions about WEBAPI Safety certification

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.