5

I'm working with a Rest Api that demands to send with any request a hash of the parameters of the request:

Hashkey Calculation This hash key has to be generated by the device itself and has to follow strict rules:

Get all request parameters and their values (except hashkey) Order theses pairs alphabetically by parameter name Concatenate all pairs using = between key and value and & between the pairs. Concatenate the resulting string with & and the API Key handed out to you by Fyber. Hash the whole resulting string, using SHA1. The resulting hashkey is then appended to the request as a separate parameter.

(http://developer.fyber.com/content/current/android/offer-wall/offer-api/index.html)

What's the reason for that?

I would assume it's security related, to prevent a 'man in the middle' to alter the parameters? If so, wouldn't it be easy for the man in the middle to send a re-generated hash with the tampered request?

5
  • 3
    This appears to be an element of their way of securing their API and requiring users to register to use it. You probably require an API Token and that API Token may become a salt to this hash. If you know how salting works, you know that you can't regenerate the hash without knowing the secret salt. Concatenate the resulting string with & and the API Key handed out to you by Fyber. -- That there is called a Salt, my friend.
    – Warren P
    Nov 6 '15 at 19:05
  • @WarrenP They do demand the usage of an API token but also demand it as a query parameter. What additional security could be gained by the mechanism you described?
    – fweigl
    Nov 6 '15 at 19:08
  • If you still don't get it, go read about what Salting is. They probably do not want you to transmit that secret in the clear, only as part of the hash.
    – Warren P
    Nov 6 '15 at 19:08
  • 1
    I do know what salting is, or let's say I have an idea ;). You were absolutely right though, they do NOT demand the api key as a parameter to the request, it is only used to produce the hash (together with the other parameters).
    – fweigl
    Nov 6 '15 at 19:10
  • The thing about secrets is you don't tell everybody. :-) I wonder how many API keys are currently up on Github right now.
    – Warren P
    Nov 6 '15 at 20:25
6

The man in the middle does not have the API Key, so they can not generate the hash.

2
  • That's what they want you to think!
    – TMN
    Nov 6 '15 at 19:54
  • I got his key, man. Anybody want it?
    – Warren P
    Nov 6 '15 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.