The front-end and back-end development methods are separated. We use the interface as the standard to promote , define the interface, develop their own functions, and finally make joint adjustments . Whether it is developing native APP, webapp or PC-side software, as long as the front-end and back-end are separated, it is unavoidable to call the interface provided by the back-end for business interaction .
For web pages or apps, as long as you grab the package, you can clearly know the data obtained by the request , and you can forge the request to obtain or attack the server; it is also a boon for crawlers, and it is easy to capture your data. So how do we solve these problems?
Interface signature
Let us first consider the problem of forged interface data and repeated calls of the interface. To solve this problem, we need to use the interface signature scheme.
Signature process
Signature rules
1. Allocate appid and appsecret offline, and allocate different appid and appsecret for different callers
2. Add timestamp (timestamp) , the data will be valid within 5 minutes
3. Join the temporary flow