为API身份验证添加UTC时间戳是一个好主意

Question

I have seen many sites such as

Amazon : (http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html) adding UTC timestamp("seconds since epoch") to HMAC for stopping replay attacks.

Many authentication tutorials and forums like How to securely maintain user authentication through a third party API? are also suggesting this.

I have only one concern in this, can it cause issue when mobile apps communicate with the API, I have checked it will not cause issue on Web when communicating with API's on web with PHP.

Answer 1

The idea with Amazon S3 is:

1. their API will create a link with the timestamp
2. amazon stores this timestamp and request separately
3. you will use that link
4. amazon will check if it is not expired for given request

For you as a user has that timestamp just a informative character and you can do whatever you want with it, it doesn't matter at all. Amazon compares stored timestamp with Amazons servertime...