如何通过HTTP保护Web服务调用

Question

What would be a best practice to secure a web service call over HTTP communication channel?

I aim to using extra parameters in query string to make time-limited hash values (generated by a calculation on client side) to define that sending request is valid. This will be understand by server side application how knows the client algorithm. But this way has a risk also when the client application is de-compiled!

So what is the best way? I'm looking for a dynamic algorithm, any thought?

Answer 1

From your comment it sounds like your need is to guard against "replay attacks" (someone sending the same request twice, when you only want for them to be able send it once). A common way to handle this is to use a nonce. At a basic level, it works like this:

1) Client wants to make a request; before doing that, it asks the server for a nonce, which is a value which will not be reused and shouldn't be predictable (eg based on the time).

2) Client gets the nonce from the server, then makes its request, sending back to the server the nonce it just got from it

3) If the client (or another client) then tries to make the request already made in step 2 above, the server won't accept it, because it'll contain a nonce which the server has already marked as "used."

That's a slight oversimplification, but that's how nonces work to prevent replay attacks.

Note: "nonce" comes from "number used once." But nonces don't actually need to be numbers.