English 中文(简体)
客户服务器应用程序的安全
原标题:Security on a client server application

I m developing a client-server app, the client is an iPhone device that communicants with my c# server. The client and server use a textual protocol that i have designed to exchange messages over TCP sockets. Can someone please give me some guidelines how to add basic security to this app? At this moment the only security element i have is client authentication with log in username and password. But for example anybody can see and read the messages sent between client and server without any problem...

最佳回答

在机动环境中,申请用户比作为开发商的用户对装置的控制更大。 隐匿秘密密码或钥匙。 你必须对恶意客户负责,因此,必须仔细了解你所暴露的功能。

将用户名和密码贴在平原文本中,违反了OWASP a9 。 您应考虑使用SSL/TLS或HTTPS。

问题回答

http://www. opensl.org/“rel=“nofollow”>opensl?SSL是提供可靠通信的加密程序。 国家安全局将防止其他人听从客户和服务器之间的流。

更应该做的是验证所有服务器投入,防止在服务器上执行恶意编码。 例如,如果您有一个数据库储存用户的投入,请查阅SQL injection/a>。





相关问题
ajax login using httpRequest?

I am trying to develop my login script to give feedback to the user if the login is valid or not. Basically if it isn t correct a div box will show saying its wrong, if its correct it will show its ...

Remotely authenticating client Windows user on demand

Suppose I am writing a server for a particular network protocol. If I know that the client is running on a Windows machine, is it possible for my server to authenticate the Windows user that owns the ...

Role/Permission based forms authorizing/authentication?

While looking into forms authorizing/authentication, I found that it is possible to do role based authorizing by adding an array of roles to a FormsAuthenticationTicket. That way I can write User....

热门标签