How to prevent data from Interception?

Question

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to communicate, I am wondering, how can I encode my Json string as well. so that, I can avoid, Session Hijacking and XSS.

Answer 1

I suggest you to take a look at the next moments and pick something that will fit your requirements for a particular task :

• a PKI to do the job of Key distribution. Pre-seed your app with your CA public key and with a client key to connect to your HTTPS. Make sure to maintain an app package integrity as hard as possible, i.e. checksums... In Microsoft Store agreement I've seen a part that allows MS to remove all digital signatures and sign a result themselves. Keys can be tampered in such a step, so beware.
• Tor or I2P for routing pattern detection avoiding. Not just where your app connects, but also how the connection behaves, i.e. network connection flow, address list, e.t.c. can be ised to cherrypick your app's traffic and divert it through malicious filters.
• FreeNet and ZeroNet for publishing read-only static for your app : if your content is signed and the signature can be verified - it is also distributed in a non-centralized way, so it's useless to "ban" or divert a traffic to "mothership node(s)"

Layering-up theese levels of protection will actually let you just pass-through your JSON communication through this secure pipe. Feel free to ask further questions - I'll be glad to help