验证从桌面应用程序到我的网站的HTTP请求

Question

I am making a desktop software in C#. This software will send Http requests to my site which has a php script to respond to the requests, at regular intervals. On my site, I need to verify that the request came from the software and not by the user from his own program. I mean the user can replicate the POST string and start making requests to my server. I guess to do that I will have to send some certificates along with the request as Microsoft Applications do it. I searched for it but did not not find anything useful.Please tell me how to authenticate .

Answer 1

What you need to do is create a cryptographic signature to append to the request in a header. What I mean by that is that you take some relevant aspects of the request like URL, form values, date / time and then create a cryptographic signature that your application presents as proof that it possesses your crypto cert. Here's a simple example:

Cryptographic Signatures

Like I said, you generate this signature and then append it as an HTTP header to the request. Then, your server software needs to verify the signature. If it can verify the signature, you can be reasonably sure that the requester possesses the cert and that the request is (probably) coming from your software.

A savvy user can still decompile your code, get the cert and construct their own requests, but at least you've made it vastly more difficult. The best you could do to protect against that would be to have your certs expire at regular intervals, but then you have to manage getting the new certs to customers.