Question

我是一家使用的服务器。 NET Web Api模板和执行其他服务。该服务器将成为移动游戏的辅助器,将储存用户的评分、进展和其他信息。我对一些做法进行了研究(href=”https://stackoverflow.com/questions/9508021/how-to-secure-api-for-mobile-applications”>,,和

User opens app for the first time

User is given option for custom username and this is checked by server so there aren t duplicates

User is given a randomly generated six-digit pin number (so they can use the same account on different phones)

User enters email address

New user is created on server (server verifies that the account was created by a valid instance of my client application)

User plays game, uploads results (Via basic authentication?)

User can view global results (no security on GET methods that aren t user specific)

我不想缩小哪类认证(没有浏览器标识,也没有这种)和授权方法。任何帮助都将受到高度赞赏。

- 男子

Answer 1

Even if you are using basic authentication you will want to use HTTPS. If you are using HTTPS then you can use client certificates to verify the client also. Only clients with a valid certificate will be given access. If you are not opening up this API to other consumers and it will only be used by a client developed by you, you may to want to consider WS-Security and WCF. There is a entertaining description of the differences using naked motorcycle drivers as a metaphor here.

Answer 2

如果它来自不同的客户/发展中国家,那么像象征性认证这样的东西可能会对你们有用。

这个想法很简单,你在网络服务中拥有认证方法。这种方法负责检查成像和发照。一些简单的结构,如SHA1或MD5,所有这些客户的电话都在使用。

如果客户获得认证,则在全会期内储存象征性物品。其余的网络服务方法,如“拯救儿童”只接受象征性的参数。然后他们负责检查是否有效。如经证明无效,则不能送达。

友情链接