in reply to A question about web service security

If you don't want refos incrementable by url, don't expose refos incrementor function by url
  • Comment on Re: A question about web service security

Replies are listed 'Best First'.
Re^2: A question about web service security
by PerlOnTheWay (Monk) on Aug 05, 2011 at 11:53 UTC
    However you expose it, it always can be faked IMO...

      Actually no. You can use a challenge/response technique. Take the MD5 hash of the current time plus some secret "seed", and send that to the client. Then, whenever the client requests that action, it must supply this MD5 hash. On the server side, you recalculate the hash for each of the last x seconds, and see if any matches what the client supplied. Only permit the action if the hash matches.

      The trick is to only deliver a hash to the client when it is a valid time to perform the action. And by restricting x to a small number of seconds, you control fairly tightly when the action can take place. So even if they do fake it, they can only fake it when it's a valid time to perform the action anyway.

        Whatever seed you choose,you need to send it to the client, and a programmer can do faking using that seed...

      However you expose it, it always can be faked IMO...

      Um, the solution is to NOT expose it

      If its private data, only the server is supposed to modify, the solution is to only let the server modify it

      I think you need to explain the architecture of your application, draw a plain ASCII diagram or flowchart

      Think of the server as a bartender, who needs to check id, serve drinks, make change ... only bartender touches the cash register, customers always have to go through bartender, and he knows how to spot fake currency, fake ids, how much vodka is left ... bartender is gatekeeper

      See The Architecture of Open Source Applications

        Don't you guys ever play web games??

        It's impractical to send a request to the server side whenever you move/click your mouth....That will no doubt cause performance issue and no one will like to play your game...