All geek questions in one place

How to check if the calling web service is my website?

For security reasons, I need to ensure that only a web client running on a particular website can access the web service. I do the verification only at the request of the domain, but I need to make it even more reliable. I find it too easy to break my security check.

+3
source share
7 answers

Sign the marker (I recommend using HMAC, at least with SHA-1). This site provides sample code for ASP.NET; I do not use .NET, so I can not check this code.

Provide the client with the HMAC token. Ask the customer to send him back to the web service with each request.

In the web service, simply verify the HMAC signature.

If your token never changes, some attackers can observe it in the client code and copy it. You can get around this by making the marker a timestamp and allowing tokens only if they are within a certain period of time, or by binding the marker to a specific user in any way.

As a safety measure, referents are not enough; they can be deleted by proxies or tampered with by malicious clients.

+1
source

, HTTP-, , Tamper Data: https://addons.mozilla.org/en-US/firefox/addon/966

cookie, , .

0

-, IP- ( - ).

, , - , , , .

- ? ?

@powtac , - , , , .

, - ; - - - - :)

0

- .

- - -. - - ( auth SSL, , - ).

, , . -, HTML-, . , - .. -. , .

0

, -, (, ), , , x //? .

0

ASP.NET, , , - . cookie , -, , .

0

.

fixed typo thanks Nosredna

-1
source

Source: https://habr.com/ru/post/1723953/

More articles:


All Articles