REST API 和 Unity3D：服务器如何区分官方 Unity 版本发送的合法请求和恶意 cURL？
--长版本--
我制作了一个超级基本的 REST API 来处理用户帐户管理（帐户创建、检查登录凭据等），我将从 Unity3D 游戏中调用它，我计划支持手机（主要是安卓）。
玩家可以上传他们使用 Unity 游戏中存在的绘图工具制作的绘图。我制作该工具的唯一目的是防止有人上传不是自己画的图画的屏幕截图，或者有人上传自拍照或色情照片（我不能允许这种可能性发生，<由于我的游戏主要针对儿童），并且这些图画可以被其他玩家公开查看。
--简短版本--
要存储上传的绘图，我将使用简单的 $_GET['base64']，但为了防止不允许的图像进入，< strong>我怎样才能确保请求来自官方的 android 版本，而不是一些 cURL 或逆向工程的 Unity 项目？
这就是整个问题。
在 WebGL 构建的情况下，我可以阻止任何不是来自 WebGL 构建所在域的 Web 请求，但在 Android 构建的情况下，据我所知，服务器无法真正告诉官方 android 版本根据 cURL 发送的某些请求发送的请求。我非常确定，只要付出一点努力，有人就能弄清楚我的 REST API 是如何工作的。我不知道如何有效地保护它。
我想要一些建议，如果您认为我当前的方法很糟糕（而且可能是），请告诉我如何改进它或用什么来替换它。
--LONG VERSION--
I made a super basic REST API to handle user account management (account creation, checking login credentials, etc.) that I will call from a Unity3D game, for which I plan to support mobile (mainly android).
Players would upload drawings that they'd make with a drawing tool that exists inside of the Unity game. I made that tool for the sole purpose of preventing the possibility of someone either uploading a screenshot of a drawing that they didn't draw themselves, or someone uploading a selfie or a pornographic photo (for which I cannot allow the possibility to happen, since my game is primarily targeted to children), and those drawings can be publicly viewed by other players.
--SHORT VERSION--
To store an uploaded drawing I would use a simple $_GET['base64'], but in order to prevent disallowed images from coming in, how can I assure that the request is coming from an official android build and not, say, some cURL or a reverse-engineered Unity project?
That's the whole question.
In the case of a WebGL build I could just block any web request that is not coming from the domain that the WebGL build is in, but in the case of the android build however, as far as I know the server can't really tell a request sent by an official android build from some request sent by a cURL. And I'm pretty sure that someone, with a bit of effort, can figure out how my REST API works. I have no idea of how to effectively secure it.
I'd like some suggestions, and if you think that my current approach is terrible (and it probably is) tell me how to improve on it or what to replace it with.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您认真防止未经授权的客户端将图像发送到您的服务器，最简单的方法就是完全忘记处理图像。
相反，我会让客户端和服务器处理输入数据。
让客户端记录用户为创建绘图所做的输入（或者，如果太多，则记录一些近似输入结果的内容，例如线段序列、颜色、描边宽度、贴纸 ID 等）您的绘图系统使用）。当他们绘制图像时，将他们刚刚绘制的图像替换为系统的图像表示形式，以便他们在发送之前可以确定图像的外观。
根据需要发送、接收和存储输入数据
当需要绘图的外观时，回放录音以再现绘图。
例如，Jackbox 基本上就是这样做的。
使用这种方法，有人可以尝试使用您的输入数据 API 重现自拍或色情内容的模糊描述，但是如果您执行诸如限制数据大小、限制颜色保真度、限制开始分辨率和线段的末端等，这些东西的再现能力越来越小，直到变得不可行。
If you are serious about preventing unauthorized clients from sending images to your server the easiest way is to forget about dealing with images entirely.
Instead, I would have the clients and servers work with input data.
Have the client record the inputs the user makes to create their drawing (or, if that is too much, something that approximates the outcome of their inputs, such as sequences of line segments, colors, stroke widths, sticker ids, whatever your drawing system uses). As they draw the image, replace what they just drew with your system's representation of it so they can be certain of its appearance before sending.
Send, receive, and store the input data as needed
When the appearance of the drawing is needed, play back the recording to reproduce the drawing.
This is essentially how Jackbox does their drawing games, for instance.
Using this method, someone could try to reproduce a vague depiction of a selfie or pornography with your API of input data BUT if you do things like limit the size of the data, limit the fidelity of the colors, limit the resolution of the start and end of the line segments, etc, the capacity for these things to be reproduced is further and further reduced until it becomes unfeasible.