Search code examples
securityauthenticationserverrestful-authenticationspoofing

Preventing spoofing attack - how to ensure my client receives orders from the real server?

I'm working on a Chrome extension that integrates with a website. My users can do actions on this website when they are logged in to it.

I have a Socket.IO server that delivers commands to my Chrome extension. Once a command arrived, the extension invokes a local function from the host website. Then, the host website, which has an authenticated active session with its own API, will invoke some update/insert call.

Normal flow

I recently realized a potential security issue, which is - if anyone spoofs my server address on my extension clients organization, he can easily abuse it to send his own parameters on behalf of my server (image 2).

Is there any smart way to ensure my client communicates with the real server and not an imposter?

Solution

  • Use HTTPS secured connection.

    This is one of the features of HTTPS (SSL/TLS) - it can prevent a MITM attack and prevent the destination server from being impersonated.

    https://stackoverflow.com/a/24586398/12595469