5

I'm working with a Rest Api that demands to send with any request a hash of the parameters of the request:

Hashkey Calculation This hash key has to be generated by the device itself and has to follow strict rules:

Get all request parameters and their values (except hashkey) Order theses pairs alphabetically by parameter name Concatenate all pairs using = between key and value and & between the pairs. Concatenate the resulting string with & and the API Key handed out to you by Fyber. Hash the whole resulting string, using SHA1. The resulting hashkey is then appended to the request as a separate parameter.

(http://developer.fyber.com/content/current/android/offer-wall/offer-api/index.html)

What's the reason for that?

I would assume it's security related, to prevent a 'man in the middle' to alter the parameters? If so, wouldn't it be easy for the man in the middle to send a re-generated hash with the tampered request?

5
  • 3
    This appears to be an element of their way of securing their API and requiring users to register to use it. You probably require an API Token and that API Token may become a salt to this hash. If you know how salting works, you know that you can't regenerate the hash without knowing the secret salt. Concatenate the resulting string with & and the API Key handed out to you by Fyber. -- That there is called a Salt, my friend.
    – Warren P
    Nov 6, 2015 at 19:05
  • @WarrenP They do demand the usage of an API token but also demand it as a query parameter. What additional security could be gained by the mechanism you described?
    – fweigl
    Nov 6, 2015 at 19:08
  • If you still don't get it, go read about what Salting is. They probably do not want you to transmit that secret in the clear, only as part of the hash.
    – Warren P
    Nov 6, 2015 at 19:08
  • 1
    I do know what salting is, or let's say I have an idea ;). You were absolutely right though, they do NOT demand the api key as a parameter to the request, it is only used to produce the hash (together with the other parameters).
    – fweigl
    Nov 6, 2015 at 19:10
  • The thing about secrets is you don't tell everybody. :-) I wonder how many API keys are currently up on Github right now.
    – Warren P
    Nov 6, 2015 at 20:25

1 Answer 1

6

The man in the middle does not have the API Key, so they can not generate the hash.

2
  • That's what they want you to think!
    – TMN
    Nov 6, 2015 at 19:54
  • I got his key, man. Anybody want it?
    – Warren P
    Nov 6, 2015 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.