Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am developing a web site and a web service for a small on-line game. Technically, I'll be using Express (node.js) and MongoDB+Redis for the databases. This the structure I came up with:

  • One Express server that will server as the Web Service. This will connect to the databases.
  • One Express server that will provide the web site. It will connect to the Web Service to retrieve and push the information.
  • iOS and Android application will be able to interact with the WebService.

Taking into account:

  • It is a small game. The information transferred is not critical.
  • There will NOT be third party applications. At least for the moment.

My concern is about which level of security I should use in each of the scenarios:

  • Security of the user playing through web browser
  • Security of the applications and the Web Server connecting to the WS.

I have take a look at the different options and:

  • OAuth and/or Https is too much for this scenario, isn't it?
  • Will be a good option to hash the user and password with MD5(or similar) and some salt?

I would like to get some directions and investigate by my own rather than getting a response like "you should you use this node.js module..."

Thanks in advance,

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I am facing a similar issue, what I am planning on is having each request signed after authentication, similar to OAuth, and a layout similar to the following.

{"header":{...},"content":{...}}

The header will contain an authentication token, and a signature hash of the content + a shared secret...

The hash for the content will be simple the content section including "{" through to "}" as JSON encoded, and sent... for cases of high-character values, they must be escaped via \u#### so that only 7-bit ascii values are present. (anything < u0032 with \x##, and greater than u0127 will be escaped with a \u####) The resulting JSON string, with only 7-bit characters will be easy enough to have a consistant signature..

Keeping the header separate from the content, will ensure the content is properly signed, and reduces the encoding issues and complexity usually seen in OAuth implementations... since OAuth is very broad. YMMV, but I hope this helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.