java - 电商项目中,每个系统提供的接口如何考虑安全问题,如何避免恶意模拟httpclient发送请求获取到用户的数据?

Answer 1

The issued certificate cannot be permanently valid or authenticated with high-end public and private keys. Only the requester and the server have the same set of encryption and decoding mechanisms.

You’re not going to tell me that the API outputs data without any authentication, right?

Answer 2

Difference through certificate or encryption and decryption

Answer 3

1. The interface uses HTTPS, which is resistant to packet capture.
2. The interface calls the token+sign mechanism. The calling end and the interface end respectively use the same set of algorithms to calculate the sign signature. The token is the public key.

Answer 4

It is recommended to take a look at WeChat’s API and Alipay’s API design plan, you will be inspired

Answer 5

https://jwt.io/

jwt