I'm working with a Rest Api that demands to send with any request a hash of the parameters of the request:
Hashkey Calculation This hash key has to be generated by the device itself and has to follow strict rules:
Get all request parameters and their values (except hashkey) Order theses pairs alphabetically by parameter name Concatenate all pairs using = between key and value and & between the pairs. Concatenate the resulting string with & and the API Key handed out to you by Fyber. Hash the whole resulting string, using SHA1. The resulting hashkey is then appended to the request as a separate parameter.
What's the reason for that?
I would assume it's security related, to prevent a 'man in the middle' to alter the parameters? If so, wouldn't it be easy for the man in the middle to send a re-generated hash with the tampered request?