将 iOS 应用程序请求签名到服务器以防止垃圾邮件
我目前有一个 iOS 应用程序，允许人们向我们的服务器提交内容（如 Twitter）。我们没有登录系统，而是依靠设备的 UDID 来唯一标识用户（是的，意识到这并不完美，但对于无需创建帐户的用户来说值得权衡）。
来自 iOS 应用程序的请求将作为 POST 请求发送到我们的服务器，并且不会以任何方式进行身份验证。
我们目前正在经历大量垃圾邮件（显然），并且正在寻找一种简单的方法来验证击中我们服务器的任何请求实际上都来自我们的应用程序 - 而不是垃圾邮件发送者编写的某些脚本。
我们尝试使用包含应用程序名称的用户代理字符串，但这很容易被欺骗。有什么方法可以验证到达我们服务器的请求是否来自我们的应用程序？
一种想法可能是包含一个随机数作为参数，然后使用一些私钥对该数字进行加密。让服务器验证加密版本与纯文本版本是否相同。 （私钥必须位于我们的服务器上并嵌入到应用程序中）。
我并不是在寻找完美的解决方案 - 易于实施的 90% 解决方案肯定是首选。
谢谢！
I currently have an iOS app that allows people to submit content to our server (twitter like). We don't have a login system, instead we rely on the UDID of the device to uniquely identify users (yes, aware that this isn't perfect but worth the tradeoff for users not having to create an account).
Requests from the iOS app are sent as POST requests to our server and are NOT authenticated in any way.
We are currently experiencing a lot of spam (obviously) and am looking for an easy method to verify that any request hitting our server in fact came from our app - and not some script that a spammer wrote.
We have tried using the user agent string which contains the app name but that is easily spoofed. Is there any way to verify that requests hitting our server is coming from our app?
One idea might be to include a random number as a parameter, and then encrypt that number with some private key. Have the server verify that the the encrypted version is = to the plain text version. (the private key would have to be on our server as well as embedded in the app).
I'm not looking for the perfect solution - a 90% solution thats easy to implement is def preferred.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我会通过以下方式解决这个问题：获取消息，使用只有您的应用程序知道的密钥对其进行加盐，并可能添加用户名和 UUID，然后使用 SHA-1 对它们进行哈希处理。如果哈希值与数据一起出现，那么它将充当数字签名，并且您可以合理地确定该消息是真实的。
共享密钥必须与您的应用程序一起分发，因此意志坚定的攻击者将能够从您的应用程序中对其进行逆向工程，但休闲垃圾邮件发送者更有可能只是寻求更有利的条件。
另一种方法是在注册时生成 pgp 私钥/公钥对，但这需要大量工作来解决这个问题。
I'd solve this by taking the message, salting it with a secret key known only to your app, and probably adding the username and UUID, then hashing them with a SHA-1. If the hash is presented along with the data, then it will act as a digital signature, and you can be reasonably sure that the message is authentic.
The shared secret key will have to be distributed with your app, so an extremely determined attacker will be able to reverse engineer it out of your app- but a casual spammer will be far more likely to just seek greener pastures.
Another approach would be to generate a pgp private / public key pair at registration- but this is a lot of work for this problem.