I am a back-end developer with very basic security skills. I need to create a secure system to allow mobile users to exchange 'points' with other users. Also an admin needs to be able to add or retrieve 'points'.

I would like to know if there is any standard procedure for this kind of system?

My plan so far was to use an https connection and standard authentication (store password hash and salt).

enter image description here

  • Everything in your post (HTTPS, hashed and salted passwords) looks good so far. However, you are only providing a very high-level overview so it would be very difficult for anyone to say whether there might be any vulnerabilities in the specifics of your implementation. Since it sounds like you are new to backend web programming, I would suggest that you read up on OWASP Top 10 Web Vulnerabilities and ensure that all of them are addressed in your application. Especially SQL injection, XSS, CSRF. – tlng05 Jan 18 '17 at 1:16

This is a pretty standard type of transaction. By far, the most important thing is that you perform the entire transaction on the server, not on the client; you cannot trust the client. To make things work nicely for an end-user, you can run these transactions on the client, but they cannot be definitive until the server has verified them.

Also, make sure you perform the whole thing in a database transaction. If you subtract 10 points from User A, then fail to add them to User B for some reason, User A would be pretty angry if they didn't get their 10 points back; it's even worse if it happens in the other direction, as users can game the system to generate free points.

One thing you may or may not be concerned about are replay attacks. Imagine that you are on my network and I MitM your connection to the server while you make a transaction to give me 10 points; then, I later resend that same HTTP request several more times to drain your account. There are a few different countermeasures you can take, but you should be able to lean on TLS to prevent this.

Which reminds me, absolutely all of your traffic that sends a session (or arguably, all traffic period) should go over HTTPS. This prevents a number of issues, like the above and session hijacking attacks. You did mention this already, but I figured I should re-iterate it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.