Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #109701

Re: Design an encrypted time-limited API on Client/Server side

Show all headers | View raw

iMath <redstone-cold@163.com> writes:

> ?I am planning design an encrypted time-limited API on both Client and Server sides, the server side is written in Django, the client side is a GUI program which call the API by
> import requests
> c = requests.post("http://127.0.0.1:8000/VideoParser/", data={'videoUrl': videoUrl })
> The way it call the API is desperately exposed to those who can use network traffic capturing tools like wireshark and fiddler

You could require the "https" protocol to prevent this.

> while I don't want anyone else could call the API with their customized videoUrl, and if people made the post call with the same parameters 2 minutes later after the client initially made the call, the call should be valid or expired, so how to design the encrypted time-limited API on both Client and Server side in this case ?

There is a general concept of "one-time-url" to handle cases such
as this one. These are urls which can be used just once.

Usually, they have associated an expiration date
and an uuid. The uuid is used on the server to maintain state (still
unused, already used); the expiration date allows state cleanup.

Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Design an encrypted time-limited API on Client/Server side iMath <redstone-cold@163.com> - 2016-06-08 09:51 -0700
  Re: Design an encrypted time-limited API on Client/Server side dieter <dieter@handshake.de> - 2016-06-09 08:55 +0200
  RE: Design an encrypted time-limited API on Client/Server side Joaquin Alzola <Joaquin.Alzola@lebara.com> - 2016-06-08 17:04 +0000

csiph-web