I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.

I know there are many payment services available. One of these is Authorize.net, which I think I will use. When a user pays for a book, he/she will get a unique link to download data from the server. I want to prevent other users who has unlawfully retrieved that link from downloading data. Additionally, I want to keep users' payment information secure.

I have no experience in security. So, please give some advice on how to implement this. Thanks.


Hacking is creativity. Applications are complex and when an attacker can look at the entire application he can see interesting ways of abusing it. In the light of a few sentences explaining some vague application I would consider the following:

1)The OWASP top 10

2)Make sure you verify the SSL certificate when connecting to the APIs you need.

3)Avoid cryptography whenever possible. It can cause a lot of problems especially if you are not a dedicated cryptographer.

4)You cannot control the client, avoid CWE-602 violations.

  • 1
    I assume that you mean by "avoid cryptography", avoid building it, not using it, correct? I would also add relevance of PCI:DSS requirements...
    – AviD
    Oct 23 '12 at 11:27
  • @AviD considering he just used SSL I can only assume that is what he meant.
    – ewanm89
    Oct 23 '12 at 12:35
  • @AviD♦ well it should be avoided in favor of another system if possible. Often cryptography is the only tool that can be used, and that is perfect place for it.
    – rook
    Oct 23 '12 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.