安全的Python客户端和服务器WebSocket

Question

I'm creating an appstore for robot applications. The setup is as follows:

• Robot running Linux and Python
• API for appstore running Django Tastypie
• Web site with appstore communicating with the API through jQuery

When a user installs an app on the web site, an API call to Django is made. Then I need Django to emit a push notification to the Robot informing him that new apps are ready to be installed. Then the Robot should make an API call to retrieve the new app and install it.

I was thinking websockets would be the best way to solve this. I would need both the server and client to be written in Python.

The complicate things a bit the API uses key authentication. Is it possible and secure to send the key from the API to the robot using websockets? Should I be using HTTPS and WSS exclusively?

Given the myriad of websocket implementations out there, is there anyone you can recommend for this scenario?

Answer 1

You main question, if you should use HTTPS / WSS to increase security can be answered easily: Yes, you should.

The other part of the question, which is a bit hidden, if the API key will be compromised when sent in clear text, depends on how you use the API key. Secure APIs will use a cryptographic hash over the key and the payload instead of the key in clear text.