API：如何从非相关用户获得访问权？
我正在开发REST API。在我的移动应用程序中，我们有多个用户角色，它们都使用相同的API。认为角色就像customer，供应商和admin。 API使用令牌，确保每个人都需要登录并应将令牌发送到API。
但是，如果某人以某种方式具有令牌，他可以轻松任何信息属于任何用户。例如，使用客户a的令牌，我们可以查看客户b，c`等的信息。
不仅如此，我们还可以使用上述令牌访问专门用于管理员的API调用。
这就是我想做的。
每个请求都会发送用户ID。还将用户ID嵌入到令牌中。在服务器中，在访问任何方法之前，请检查请求和令牌中的用户ID是否相同。
仅供参考，我正在使用Firebase身份验证和令牌，然后使用AWS API网关来验证对API的访问。我指的是数据库中的用户ID。
您如何认为我可以克服此问题并确保API？
I am developing a REST API. In my mobile application we have multiple user roles, they all use the same API. Think the roles are like customer, supplier, and admin. The API is using tokens, making sure everyone need to be logged in and should send the token to the API.
However, if someone has the token somehow, he can easily any information belong to any user. For an example, using the token of customer A, we can view the information of customer B, C` and so on.
Not only that, we can also access the API calls dedicated for the admins using the above mentioned token.
this is what I thought of doing.
Send the user ID with every request. Also embed the user ID into the token. In the server, before any method is accessed, check whether the user id in request and token are the same.
FYI I am using Firebase authentication and tokens, then use AWS API Gateway to authenticate the access to the API. The user Id I was referring to is in database.
How do you think I can overcome this issue and secure the API?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
只要您确保仅通过有安全的连接将令牌传递，则该令牌的拦截不是很有可能。如果您使用短寿命令牌（例如Firebase的ID令牌），即使令牌确实被拦截，它只能在短时间内使用。
如果令牌确实被拦截，则可以撤销令牌，如管理用户会话。
最后，您可以考虑实现应用程序检查用于附加的保护层，并且a href =“ https://firebase.google.com/docs/app-check/custom-resource-backend” rel =“ nofollow noreferrer”>检查是否在您自己的后端中示意一下。
As long as you make sure to pass the tokens only over secured connections, interception of that token is not very likely. If you then use short-lived tokens (such as Firebase's ID tokens), even when a token does get intercepted it can only be used for a short amount of time.
If a token does get intercepted, you can revoke the token, as shown in the Firebase documentation on managing user sessions.
And finally, you can consider implementing App Check for an additional layer of protection, and check that token too in your own backend.