Re:API responses should be signed
by LoSboccacc on Monday January 20, 2020 @03:06AM
(#22097236)
and how do you suppose to get the end user the certificate? because if it's trough the same channel, none of this matter.
[ Parent
| on HN ]
Re:API responses should be signed
by DarkWiiPlayer on Monday January 20, 2020 @08:11AM
(#22098535)
The idea (if I understand it correctly), is that you can get a signed API resopnse from anywhere, and the public key from the signer to verify the legitimacy of the data in the API response without having to call the API again.