Encrypt json data with secret key on IOS and decrypt it with node js

Question

I need to protect my API for CSRF on post and put requests.

To do that, I think the mobile device (example iOS) need to send to the API server (node.js) a token. This token must be encrypted and contain a JSON data that will be decrypted server side.

To decrypt the data, the mobile device use the same secret key that the sever know.

For example : {_csrf: 123456789} will be decrypted from the token sent via the mobile device and checked by the API if it match.

Is it the right way ? If not what is the right way ?
How I can encrypt a Jon data on iOS and decrypt it on node.js ? (JWT Token does not have library for iOS)

Can you provide me a example code to encrypt data on iOS et decrypt on node.js ?

zaph · Accepted Answer · 2015-07-02 11:09:31Z

1

Just use https, it encrypts everything, even any query string.

The content is encrypted with a random symmetric key and that key is encrypted with a asymmetric key from the certificate. Additionally the symmetric key has a short lifetime. Additionally you do not have to implements and encryption routines.

Also note that iOS9 will by default require https to be used for all connections, any http connections will need to be white-listed in the plist.

If you do your own encryption you immediately have a problem sharing the encryption key between the device and the server. This is not an easy problem to solve.

edited Jul 2, 2015 at 11:09

answered Jul 2, 2015 at 11:03

zaph

113k21 gold badges196 silver badges234 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Jim Flood Over a year ago

This will NOT protect from CSRF. This is not secure at all. With CSRF, the browser itself is the problem. You must still protect against CSRF.

zaph Over a year ago

There is no potential CSRF attack because there is no browser.

Jim Flood Over a year ago

"I need to protect my API for CSRF on post and put requests." "Just use https..." Yes, this is the part that is not secure. HTTPS does not protect against CSRF. Sorry if I came off a little strong. @zaph

Jim Flood Over a year ago

Yes, I see your comments -- there is no browser. You might want to update your answer to read, "HTTPS is fine... as long as there is no browser." Otherwise, the question reads "protect against CSRF" and your answer reads, "just use HTTPS."

Jim Flood · Accepted Answer · 2015-07-06 23:55:49Z

0

When accessing the API from a browser page, to protect against CSRF, you can send a token in HTTP headers, for example, X-CSRF-Token, or, use a cookie.

For example, have your server send the CSRF token in an HTTP response using the X-CSRF-Token header. You can have your page send it back in the JSON on the POST or PUT. Or have your page read it from the cookie and put it into the JSON.

(HTTPS from the browser will not protect against CSRF, since any script on any other site running in the same browser can POST to your HTTPS server freely. Your page needs to have a token that no other page in the same browser has access to.)

edited Jul 6, 2015 at 23:55

answered Jul 3, 2015 at 18:12

Jim Flood

8,5174 gold badges41 silver badges49 bronze badges

Collectives™ on Stack Overflow

Encrypt json data with secret key on IOS and decrypt it with node js

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related