防止 API“欺骗”或“黑客攻击”
我创建了这个网络应用程序，并且创建了这个 API。为了这个示例，让我们保持简单：
我的应用程序需要知道用户有多少“积分”。 该 API 有一个调用 get_credits，该调用返回 {credits: 1000 }。
现在，我如何防止某人使用主机文件（或其他方法）创建他自己的返回 {credits: 2000 } 的 API。
我正在考虑插入某种哈希值，但因为它是 JavaScript，所以很容易从源中提取哈希值。我想握手也是如此。
那么，如何让API足够安全呢？
I have created this web app and I created have this API. For the sake of this example, let's keep it simple:
My app needs to know how many "credits" the user has.
The API has a call get_credits that returns { credits: 1000 }.
Now, how do I prevent somebody to use a hostfile (or some other method) to create his own API that returns { credits: 2000 }.
I was thinking of inserting a hash of some sort, but because it is JavaScript, the hash is easily extracted from the source. Same goes for a handshake I guess.
So, how do I make the API secure enough?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您必须以不同的方式来做，才能拥有一个真正安全的应用程序。您永远不应该信任最终用户的应用程序，因为用户或黑客可能可以修改代码。
所以我建议将所有购买等保留在服务器上。因为我现在对你的系统了解不多，所以我无法为你提供太多帮助。
如果服务器为每个商品生成一个哈希值，那么该哈希值可以允许用户向其他用户显示他确实购买了该商品，那就太好了。
请注意，这个哈希值必须长且唯一，否则用户可能会暴力破解它们。
我希望你理解我的意思，我的回答可以帮助你;-)
You'll have to do it a different way, to have a really secure App. You should never trust the App, by the enduser, because perhaps the user or hacker could modify the code.
So I recommend to keep all the purchases etc. on the server. Because I don't now much about your system I can't help you very much.
It would be good, if for every item a hash is generated by the server, this hash could allow the user to display to other users, that he really purchased the item.
Please note that this hash must be long strong and unique, because otherwise users could brutforce them.
I hope you understand my and my answer can help you ;-)
如果是客户端，您无能为力 - 尽最大努力。但您必须确保在回发时验证回复。永远不要相信用户:-)
If it's client side there is not much you can do - make a best effort. BUT you must ensure that on the post back you validate the reply. Never trust users :-)
我现在要告诉你我的系统是如何工作的。
为了在游戏期间获得积分，我发出 ajax 请求来加载它们。 ajax 请求调用一个简单的 php 页面，其中有一个“echo $credits;”。所以，破解是不可能的。如果有人修改客户端信用，当他们请求礼物时，我会使用 php 检查服务器端信用以确保它们是合法的：P - 请考虑检查您的系统是否容易受到 mysql 注入攻击，以防止有人破解你的信用系统:D
i'm now going to tell you how my system work.
to get the credits during the game, i make an ajax request to load them. The ajax request call a simple php page where there is an "echo $credits;". So, it's impossible to hack. if someone modify the client-side credits, when they request a gift i check with php the server-side credits to be sure them are legitim :P - Please consider to check if you sistem is vulnerable to mysql injection attacks, to prevent someone will hack you credits system :D