Question

Where currently working on an C# application that requires data to be stored in central location.

The application will authenticate the user via the server, which in turns returns a session via the headers.

Then the C# application would then use the CDN to send and collect data from/to the server.

What I want to accomplish is to be able to verify its the C# application sending or requesting the data and not some script mimicking the headers and data.

What methods are there in validating each side of the request so that the C# Application can validate the Server data and also the other way around.

Thanks.

Answer 1

This scenario is easily solved using public-key cryptography:

A simple solution is to encode a hash of the data (and potentially a timestamp / sequence number) with the public key of the “other side.” This can be used to guarantee, upon decryption with the private key upon receipt and a comparison of the hash value (and potentially a timestamp / sequence test), that the (expected) sender actually sent the data.