强化 HTTP 流量使其不可重现的想法
我有一个项目，需要在 HTTP Web 服务器上进行安全交易。我完全控制客户端（移动应用程序）并控制服务器。我想开发一个系统，客户端可以在其中添加或减去服务器数据库中存储的值。存储的价值是基于货币的，因此数字准确非常重要。我的问题是如何防止某人复制 HTTP 流量并随意删除或添加值。有人可以从客户端捕获数据包，查看修改服务器货币值所需的 HTTP POST 参数，并在需要时重现这些数据包。
我的第一个想法是让客户端用公钥加密新的货币值，然后让服务器用私钥解密。我还会在加密之前嵌入时间戳及其用户名以及新的货币值，因此请求始终会有所不同。然后，服务器将检查时间戳，如果超过 10 秒则拒绝。这种方法的一个问题是客户端或服务器是否基于时间不同步。服务器将与 NTP 同步，但不能保证客户端是正确的
任何其他想法将不胜感激。我不是在寻找低级实现细节，只是在寻找高级概述。理想情况下，该解决方案不会对客户端或服务器造成太大负担，因为交易率会很高。
I have a project where I need to make secure transactions on a HTTP web server. I completely control the client (mobile application) and control the server. I want to develop a system where the client can add or subtract a value stored in the server's database. The value stored is currency based so it is important that the number is accurate. My question is how I can prevent someone from reproducing the HTTP traffic and removing or adding values at will. Someone could take a packet capture from the client, view the HTTP POST parameters necessary to modify to server's currency value, and just reproduce those packets whenever they want.
My first thought was to have the client encrypt the new currency value with a public key and then have the server decrypt it with a private key. I would also embed a timestamp and their username along with the new currency value before it gets encrypted so the request would always be different. The server would then check the timestamp and reject if it's past 10 seconds. One problem with this approach is if the client or server are out of sync time based. Server would be synced with NTP but there is no guarantee that client will be correct
Any other ideas would be appreciated. I'm not looking for low level implementation details, just the high-level overview. Ideally the solution would not be too taxing for either the client or the server since the rate of transactions will be high.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
一般安全提示：如果客户端在野外，您将无法控制它！服务器必须检查客户端发送的所有内容。
简单流程：
允许这样做，执行命令并向
客户指示失败或成功。
会话也应该在设定的时间段后超时）。
笔记：
一切都必须在服务器端进行身份验证和检查！您的客户端应用程序不应该负责确定什么是“有效”请求，什么不是“有效”请求 - 这是服务器的工作。每个请求都应通过 SSL 进行，并且仅应在客户端成功登录并启动会话后执行。即使使用基于时间戳的检查，有人也可以对您的客户端进行逆向工程或使用中间人攻击，但前提是他们有用户名/密码（或者能够拦截合法客户端的数据 - 使用 SSL/公钥/私钥系统）。如果需要非常强的安全性，则来自客户端的每个请求都应该通过 RSA 加密。
A general security tip: You do NOT control the client if it's out in the wild! The server must check everything the client sends.
Simple flow:
allowed to do this, executes the command and sends a response to the
client indicating failure or success.
session should also timeout after a set period as well).
Note:
Everything must be authenticated and checked server-side! Your client application should not be the one in charge of working out what is a "valid" request and what is not - that's the job of the server. Each request should go via SSL, and should only be executed once the client has successfully logged on and started a session. Even with a timestamp-based check, someone could reverse engineer your client or use a man-in-the-middle attack, but only if they have a username/password (or are able to intercept a legitimate client's data - hard with SSL/public/private key system). If very strong security is mandatory, every request from the client should be encrypted by RSA.
您应该只使用 HTTP Secure
You should just use HTTP Secure