How to ensure communication security--url signature **16.app back end

In the app and backend communication process, API requests may be intercepted by others or accidentally leaked. So, how to ensure the security of API requests? In this article, we describe a common approach to secure API requests--url signatures.

1. URL Signature Detailed

In the previous article <15.app how to design a user login scenario >, the server verifies that the user name and password are correct, generates a random, non-repeating token string (such as "DAF32DA456HFDH"), Maintain an image table in Redis or memcache, create a corresponding relational table of token strings and user information, for example, to match the token string "DAF32DA456HFDH" with the user ID "5". The server returns the token string to the app as an authentication.


This authentication is dependent on the token string. If a user leaks his or her URL, the token is largely compromised by others.


How to prevent token from being compromised? Do not allow tokens to be transmitted over the network.


Note that this URL signature method is the same as the front <15.app backend how to design the user login scheme is closely linked together, did not read the previous article please look first.


(1) When the server verifies that the user name and password are correct, the token string and the user ID are returned to the client, such as the token string "DAF32DA456HFDH" and the User ID "5".


(2) Assuming that the API request is "Test.com/user/info", after generating the MD5 signature through the token string "DAF32DA456HFDH": MD5 ("test.com/user/info&token= DAF32DA456HFDH ") = c99dc0c22437ac275c08ce4a9708b25a


As a result, the API request is labeled "test.com/user/info?userid=5&sign= c99dc0c22437ac275c08ce4a9708b25a" after signing and user identification


(3) After the server receives this URL, using the (2) algorithm to generate the signature and the sign parameter comparison, if found equal, it means that the URL is valid, then continue to execute the API call.


With this method, tokens can be avoided when the API call is compromised.


The above approach also has a problem because the API request "test.com/user/info?userid=5&sign= c99dc0c22437ac275c08ce4a9708b25a" does not have an expiration time, Assuming that someone else gets the request for this API, it can be called repeatedly.


The improved method is to increase the timestamp in the passed parameter, and when the time stamp is found to be long, the URL has been invalidated.


But how do you keep your app's time and server time in sync with timestamps? In the app each time it starts and the server syncs, and then the app built a clock, timestamp in the app's internal clock gets, prevent users to modify the phone time caused by inconsistent time.


The following improvements have been made:


(1) Assuming that the API request is "Test.com/user/info", after generating the MD5 signature with the token string "DAF32DA456HFDH" and the Timestamp: MD5 ("test.com/user/info?userid=5& token=daf32da456hfdh&timestamp=1425860757 ") = c116161a6f430343b6cecf08562f1371


The API request, with the signature and user ID, is then "test.com/user/info?userid=5&timestamp=1425860757&sign= c116161a6f430343b6cecf08562f1371 "


(2) The server receives this API request, if it is found that the time to receive the URL request and time=1425860757 long interval, it is determined that the URL is intercepted by others to call repeatedly. If time is legal, then use the (1) algorithm to determine if sign is consistent

2. Disadvantages of URL Signing

There are two disadvantages of URL signing:


1. When the user first login token is clear text return, there is a risk of interception


2. The URL signature only protects the token value but does not protect other sensitive data, for example, when a user updates his or her personal information, all information should be encrypted during transmission

How to solve these two problems? Using the symmetric encryption algorithm described in the next article is possible.

http://blog.csdn.net/newjueqi/article/details/44154791

How to ensure communication security--url signature **16.app back end