Questions about WEBAPI Safety certification

Before the project encountered an external provider of API issues, some superficial ideas, the time to record.

The following discussion is all about solving the problem of who is eligible to call this API (who has permission to do this)

To simplify your thinking, take an example of a student viewing Java class.

Xxx/java/stuclass?name=java

1. The simplest is not encryption, such as on the request, this will cause as long as the user who knows the API can send the request, if used by people, the request, waste a lot of resources.

2. After the request is followed by a specific set of annotation characters, the annotation character conforms to the requirement to continue execution. This creates problems with the same 1

Xxx/java/stuclass?name=java&ticket=abedf

3. Encrypt the unique authentication information of the API user (asymmetric and symmetric). This attachment information is sent to the background, the background after receiving decryption, to determine whether the user identity is legitimate.

Xxx/java/stuclass?name=java&ticket=15ff57fger

4.3 The problem is that if a person is maliciously exploited ticket, it will still be requested more than once, so it would be better if the identity information and the valid time information (from the background) are encrypted to send to the background.

Questions about WEBAPI Safety certification