1

I have been studying a bit on security on how to make my mobile rest server secure. I am looking at one mobile application that uses plain HTTP.

I have Charles proxy breakpoint enabled and edit the post data before submitting to their server. For example when I edit the "request" from

[{"func":"HeartBeat","time":1475481665} ]

to 

[{"func":"HeartBeat","time":1475481777} ]

I got a "wrong signature" response. How did their server know that the "request" data was tampered in the first place?

Screenshot from Postman.

All I know is the session is the current user, signature and request might be connected somehow. I think I need to generate a new signature when editing the request data.

Improve this question
1
  • 4
    @keithics: in this case the specific application adds some signature (probably in the sig field) to protect the rest and thus the server detects the tampering. To successfully tamper you would need to find out how the signature is generated - which is off-topic here.
    – Steffen Ullrich
    Oct 3, 2016 at 10:06

1 Answer 1

Reset to default
2

One way to ensure security is to have the client create a Message Authentication Code for the request and then send the MAC along with the data. The server will recreate the MAC and then validate it against that what was sent.

This is probably what is happening in your example with the "signature".

Improve this answer
0

Not the answer you're looking for? Browse other questions tagged .