I’ve seen questions that are almost identical to this one, except minor but important differences that I would like to get detailed.
Let’s say that I have a controller and an action method in MVC which therefore accepts requests on the following URL: http://example.com/api/myapimethod?data=some-data-here.
This URL is then being called regularly by 1000 clients or more spread out in the public. The reason for this is crowdsourcing. The clients around the globe help feed a global cache on my server, which makes it faster for the rest of the clients to fetch the data.
Now, if I’m sneaky (and I am), I can go into Fiddler, Ethereal, Wireshark or any other packet sniffing tool and figure out which requests the program is making.
By figuring that out, I can also replicate them, and fill the service with false corrupted data.
What is the best approach to ensuring that the data received in my ASP .NET MVC action method is actually from the desktop client application, and not some falsely generated data that the user invented?
Since it is all based on crowdsourcing, would it be a good idea for my users to be able to “vote” if some data is falsified, and then let an automatic cleanup commence if there are enough votes?
I do not have access to a tool like SmartAssembly, so unfortunately my .NET program is fully decompilable. I realize this might be impossible to accomplish in an error-proof manner, but I would like to know where my best chances are.
Any solution is ultimately unreliable, so you have to effectively give the keys to the end user to use the system.
Having a system where users can vote down bad content is best, but then you need a reputation system or some sort of trust mechanism so that your users can tell the bad data is bad data because it came from an untrusted source.
SSL only defends against man-in-the-middle attacks.
How much time you spend coming up with a system depends on how important it is to you & your users & how likely it is someone will attack your system