I have been studying a bit on security on how to make my mobile rest server secure. I am looking at one mobile application that uses plain HTTP.
I have Charles proxy breakpoint enabled and edit the post data before submitting to their server. For example when I edit the "request" from
I got a "wrong signature" response. How did their server know that the "request" data was tampered in the first place?
All I know is the session is the current user, signature and request might be connected somehow. I think I need to generate a new signature when editing the request data.