简体繁体 English

签署iOS应用程序请求服务器以防止垃圾邮件

[英]sign iOS app requests to server to prevent spam

原文 2011-11-14 23:25:52 5 1 iphone/ ios/ security/ encryption/ spam

I currently have an iOS app that allows people to submit content to our server (twitter like). 我目前有一个iOS应用程序，允许人们向我们的服务器提交内容（像Twitter一样）。 We don't have a login system, instead we rely on the UDID of the device to uniquely identify users (yes, aware that this isn't perfect but worth the tradeoff for users not having to create an account). 我们没有登录系统，相反，我们依靠设备的UDID来唯一地识别用户（是的，知道这不是完美的，但值得为不必创建帐户的用户进行权衡）。

Requests from the iOS app are sent as POST requests to our server and are NOT authenticated in any way. 来自iOS应用程序的请求将作为POST请求发送到我们的服务器，并且不会以任何方式进行身份验证。

We are currently experiencing a lot of spam (obviously) and am looking for an easy method to verify that any request hitting our server in fact came from our app - and not some script that a spammer wrote. 我们目前正在经历大量的垃圾邮件（显然），我正在寻找一种简单的方法来验证任何命中我们服务器的请求实际上来自我们的应用程序 - 而不是垃圾邮件发送者编写的某些脚本。

We have tried using the user agent string which contains the app name but that is easily spoofed. 我们尝试使用包含应用名称的用户代理字符串，但很容易被欺骗。 Is there any way to verify that requests hitting our server is coming from our app? 有没有办法验证命中我们服务器的请求来自我们的应用程序？

One idea might be to include a random number as a parameter, and then encrypt that number with some private key. 一个想法可能是包含一个随机数作为参数，然后用一些私钥加密该数字。 Have the server verify that the the encrypted version is = to the plain text version. 让服务器验证加密版本是否为纯文本版本。 (the private key would have to be on our server as well as embedded in the app). （私钥必须在我们的服务器上以及嵌入在应用程序中）。

I'm not looking for the perfect solution - a 90% solution thats easy to implement is def preferred. 我不是在寻找完美的解决方案 - 一个易于实施的90％解决方案是首选。

Thanks! 谢谢！

1 个解决方案

I'd solve this by taking the message, salting it with a secret key known only to your app, and probably adding the username and UUID, then hashing them with a SHA-1. 我通过接收消息来解决这个问题，用只有你的应用程序知道的秘密密钥来保存它，并且可能添加用户名和UUID，然后使用SHA-1对它们进行哈希处理。 If the hash is presented along with the data, then it will act as a digital signature, and you can be reasonably sure that the message is authentic. 如果哈希与数据一起呈现，那么它将充当数字签名，您可以合理地确定该消息是真实的。

The shared secret key will have to be distributed with your app, so an extremely determined attacker will be able to reverse engineer it out of your app- but a casual spammer will be far more likely to just seek greener pastures. 共享密钥必须与您的应用程序一起分发，因此一个极其坚定的攻击者将能够从您的应用程序中对其进行逆向工程 - 但是一个随意的垃圾邮件发送者将更有可能只是寻求更环保的牧场。

Another approach would be to generate a pgp private / public key pair at registration- but this is a lot of work for this problem. 另一种方法是在注册时生成pgp私钥/公钥对 - 但这对于这个问题来说是很多工作。