.Net应用程序与网站之间的安全通信

Question

Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our application to check for the User validity and those ideas came up

1. Using WebClient to enter to our website and Login using the user provided credentials : However, this might be vulnerable to MITM attack.
2. Using the first approach but using SSL certificate (to make sure that we are connecting to our server and not the attackers') : However, Fiddler can easily do a MITM attack and decrypt the SSL communication, which will result in the same vulnerability as the first approach.

Due to the internet's lack of documentation of what we need, we had to ask here for someone to explain how could we make sure that:

1. Our application only connects to our server and not any fake hosted server (by the attacker).
2. The communication is secure. Not altered or edited some how in order to grand unfair access to our application. (by sending a fake response to the app or editing the original response before the application receives it).

---

Note: we totally understand that the attacker may just deobfuscate the application and do whatever he want to it. So we are planning to get a good Note: we totally understand that the attacker may just deobfuscate the application and do whatever he want to it. So we are planning to get a good obfuscator in order to at least make it harder for the attacker to do so.

Answer 1

You can use SSL Certificate Pinning.

Set the ServerCertificateValidationCallback to only accept your certificate's public key, or one of its signers. (this means you can never change certificates)

This will completely prevent SSL MITM (which works by using a different certificate and making the computer trust it).

Of course, it doesn't prevent attackers from cracking open your app and bypassing the check altogether, especially if you store local state.