我真的需要使用随机数吗？
我目前正在开发一个适用于 iOS 设备的应用程序。该应用程序从 WordPress 博客下载数据，但首先获取随机数令牌。这已经过测试，显示大约需要 2~3 秒，考虑到它是移动设备，应该在几秒钟内准备好数据，这个时间已经很长了。除此之外，还需要下载数据，这又需要4~5秒。
在数据获取方法中，采取了多种安全措施，例如需要在网络服务器和设备上匹配的秘密字符串（当然是加密的），以及某种简单的 UDID 验证+一些标头和用户代理测试。这足够了，还是我真的需要随机数？这并不是说有任何敏感数据被传递，如果是的话，我当然会进一步加密它。
我真的有必要使用随机数吗？
谢谢。
I'm currently developing an app for iOS-devices. This app downloads data from a wordpress blog, but fetches a nonce-token first. This has been tested, and is showing to take about 2~3 seconds, which is a lot, considering it's a mobile device that should have the data ready in a few seconds. In addition to this, the data has to be downloaded as well, which takes another 4~5 seconds.
In the data-fetching-method there are several security-measures taken, for example a secret string that needs to match on both the web-server and device (of course encrypted), and some sort of simple UDID-validation + some header and useragent-tests. Is this enough, or do I really need the nonces? It's not like there is any sensitive data being passed through, and if it was, I'd of course encrypt it further.
Is it really necessary for me to use nonces?
Thank you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您正在下载公共数据，则不需要随机数身份验证内容。
如果您要修改服务器上的数据，或者获取非公开的数据或以其他方式对其进行某种访问控制，那么您将需要 WordPress 所需的任何机制来获取访问权限（这听起来像是一个随机数）基于令牌的方法）。
如果需要几秒钟才能获取该令牌，那么在应用程序启动/恢复时在后台获取它怎么样？
If you are downloading public data, there's no need for the nonce authentication stuff.
If you are going to be modifying data on the server, or fetching data that is not public or otherwise has some kind of access control around it, then you'll need whatever mechanism Wordpress requires to gain access (which it sounds like is a nonce-based token approach).
If it's taking a few seconds to get that token, how about fetching it on app startup/resume in the background?