I have been studying a bit on security on how to make my mobile rest server secure. I am looking at one mobile application that uses plain HTTP.
I have Charles proxy breakpoint enabled and edit the post data before submitting to their server. For example when I edit the "request" from
I got a "wrong signature" response. How did their server know that the "request" data was tampered in the first place?
All I know is the session is the current user, signature and request might be connected somehow. I think I need to generate a new signature when editing the request data.
sigfield) to protect the rest and thus the server detects the tampering. To successfully tamper you would need to find out how the signature is generated - which is off-topic here.