We have SSL communication between our mobile app and our servers.
The request from mobile is creating a hash on all the request fields - based on a secret key which is "stored" on the app.
So it sends json with all the fields data, plus a signature value which is :
hash = hashBasedOnKey ( all request data fields)
Later, the server does the same thing. It reads the fields and run hash on those fields ( server also has the secret key) and if the hash are the same , then it means that the data was not altered.
Is it really needed when using SSL communication ?
A MITM can't alter the data , except for SSL stripping.
But again, the mobile app uses SSL communication.
IMHO - ssl stripping is when non ssl "thinks" it connects to ssl , without noticing, where the MITM does the SSL by itself to the destination, and strip the
https data , and return the
Is hashing the data in the client, crucial? or is it useless?