如何安全地从我们的网站下载最新的XML文件？

Question

We're writing a console app which is to be installed on client's machines. It's possible we'll want to update an XML file used by the app. How can I ensure the file is downloaded safely from our servers, eg no malicious files instead?

I presume the app would call our API to get the latest version number. If its newer than what it has, it would download this XML file from the specified URL. However doesn't this make it vulnerable to man in the middle attacks or similar? I want to ensure our app is not responsible for downloading a malicious file (eg could be a malicious exe file).

Any help/guidance would be appreciated!

Answer 1

You need to sign the XML file with a private key on your server, then verify it on the client with a public key embedded in your app.

This will only help if you have a secure mechanism to deliver the initial app with its public key (eg, HTTPS)

Answer 2

Serve the file over https and make sure the client checks the certificate. That way you're sure the file comes from the correct server and is not changed somewhere on the line. Assuming you keep your server secure that should be enough to be sure you get the correct file.