Home/ Questions/Q 8845833
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-14T11:49:42+00:00

I’ve asked a question related to this one here: Securely Passing UserID from ASP.Net

  • 0

I’ve asked a question related to this one here:

Securely Passing UserID from ASP.Net to Javascript

However now I have a more detailed/specific question. I have the service and I have the application that is going to consume the service my plan to secure it, is to generate a hash based on some values, a nonce, and a secret key. My only issue is that it seems that in order to verify the hash I will have to send all of the values plus the nonce, except the secret key. Is this a flaw in my design or is this how such things are done? I have googled around and haven’t been able to find out if this is the right and secure way to do this.

For example lets say I need to pass values 1,2, and 3 to my rest service, so I users phone number, the nonce, and, the secret key to generate a hash, now in order to generate the hash again I would need to pass all of the above except the key (which I can retrieve based on the users phone number).

I am totally leaving my service up for attack, securing it properly, or somewhere in between?

EDIT: made a spelling and grammar correction

EDIT 2: Finally came to to a satisfactory solution by using MVC 4 with forms authentication, identical cookie names between two projects, and making use of a globally applied [Authorize] attribute

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There is nothing inherently wrong with this plan. If the client sends:

    data . nonce . hash(data . nonce . shared-secret)

    Then the server verifies the message by checking that hash(data . nonce . shared-secret) matches the hash provided by the client, you would be safe against both tampering and replay (assuming, of course, that you’re using a reasonable cryptographic hashing algorithm).

    Under this design, the client can even generate its own nonces, provided there is no risk that two clients will generate the same nonce.

    However, eavesdroppers will still be able to see all the data you send… So, unless there is a very good reason not to, I would simply use https (which, unless there are other requirements I’m unaware of, be entirely sufficient).

    • 0