Lets suppose my program makes a http request and uses it response to update some values. Is it possible to somehow mimic the response in order to modify it so the program believes the server responded when in fact it was a hardcoded response? I'm not using HTTPS.
-
1Yes, e.g. with Fiddler– CodesInChaosDec 16, 2014 at 15:46
-
Why do you ask that question?– CodesInChaosDec 16, 2014 at 15:47
-
I'm developing a program which makes an http request to retrieve 'credits' that the user is able to use. Despite the clients using it are very few and the chances of being hacked is close to zero, I wanted to take some security measures. Thanks– ValloDec 16, 2014 at 15:50
-
1You want to implement some kind of licensing or DRM scheme?– CodesInChaosDec 16, 2014 at 15:53
-
2@Vallo Keep in mind that it is not possible to make it not possible to bypass your client-side check. (Worst case scenario: someone rewrites your client program from scratch, but without the part that makes it require credits.)– user253751Dec 17, 2014 at 2:28
|
Show 7 more comments
1 Answer
Yes, it's possible and it's trivially easy.
You can make it a bit harder by using HTTPS and a pinned certificate but that will not stop anyone with a bit of time on their hand (they will then need to modify your executable, or, at least, the container where you placed your pinned certificate) and it will make it harder to manage your server (because if you need to change your certificate, you'll need to update your clients as well).
