Data encryption on restful service_问答_开发者

开发者 https://www.devze.com 2023-03-11 22:20 出处：网络

Is there a way to encrypt the data passed through a restful service? I have a service getUser which accepts user ID and provides user info.

Is there a way to encrypt the data passed through a restful service?

I have a service getUser which accepts user ID and provides user info. According 开发者_如何转开发to the restful tutorials, I'm supposed to send a query like this in order to get user info: http://myrestfulserver/getUser/123 where 123 is user id. Is there a simple way to encrypt 123 using https without implementing proprietary security level?

Yes, but to understand what's going on you probably need to have a play with telnet.

Basically, there are three stages in SSL, whereas in HTTP (plain) there are two.

Open a socket to the server.
Negotiate encrypted channel.
Send encrypted data.

So, 1) is literally a connect. 2) doesn't happen in HTTP, but does with HTTPS, then 3) is HTTP in both cases. What does HTTP look like? Use telnet:

$ telnet google.com 80
Trying 209.85.227.103...
Connected to google.com.
Escape character is '^]'.
GET / HTTP/1.1 # <---- I typed this

HTTP/1.1 302 Found
Location: http://www.google.co.uk/
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=71ab4b30677eaa81:FF=0:TM=1307626411:LM=1....
Date: Thu, 09 Jun 2011 13:33:31 GMT
Server: gws
Content-Length: 221
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://www.google.co.uk/">here</A>.
</BODY></HTML>
...
...

Ok, so what you should understand from this is that the connection and requesting the part of the url you want are separate things. Back to our three stage thing:

Connect to yourrestfulserver.com
Establish SSL
Issue GET /getUser/123 HTTP/1.1

As you can see, 3) is done over an encrypted connection, so the entire URL is invisible to anyone sniffing the operation, not just the identifier, so there is no need to encrypt the url option for OTA concerns.

As for client side access, unless you or the process you use deliberately logs this information, it is also encrypted.