Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our application to check for the User validity and those ideas came up
WebClientto enter to our website and log in using the user provided credentials : However, this might be vulnerable to
- Using the first approach but using
SSLcertificate (to make sure that we are connecting to our server and not the attackers') : However, Fiddler can easily do a
MITMattack and de-crypt the
SSLcommunication, which will result in the same vulnerability as the first approach.
Due to the internet's lack of documentation of what we need, we had to ask here for someone to explain how could we make sure that:
- Our application only connects to our server and not any fake hosted server (by the attacker).
- The communication is secure. Not altered or edited some how in order
to grant unfair access to our application. (by sending a fake
response to the app or editing the original response before the
application receives it