iMath <redstone-c...@163.com> writes:
> ?I am planning design an encrypted time-limited API on both Client and Server
> sides, the server side is written in Django, the client side is a GUI program
> which call the API by
> import requests
> c = requests.post("http://127.0.0.1:8000/VideoParser/";, data={'videoUrl':
> videoUrl })
> The way it call the API is desperately exposed to those who can use network
> traffic capturing tools like wireshark and fiddler
You could require the "https" protocol to prevent this.
> while I don't want anyone else could call the API with their customized
> videoUrl, and if people made the post call with the same parameters 2 minutes
> later after the client initially made the call, the call should be valid or
> expired, so how to design the encrypted time-limited API on both Client and
> Server side in this case ?
There is a general concept of "one-time-url" to handle cases such
as this one. These are urls which can be used just once.
Usually, they have associated an expiration date
and an uuid. The uuid is used on the server to maintain state (still
unused, already used); the expiration date allows state cleanup.
--
https://mail.python.org/mailman/listinfo/python-list
