Sign up ×  Would implementing signed URL's be an effective
security measure to prevent URL tampering and poisoning on
public facing resources accessed via a GET request.   Hash in my
case would correspond to my cache key for the resource.  Any
feedback, improvements, or critiques would be greatly
appreciated.  share|improve this question  2 Answers 2  up vote
1 down vote accepted  If it's being altered coming from the
client, then we'd also need a mechanism for client certificates
to have trust. To avoid alterations on the connection coming
from the server, SSL would already cover this and more. Really,
I fail to see what this would offer over the capabilities of SSL
unless you are simply looking for a lighter weight way to
protect links without having to use a full SSL connection.  This
also seems like it would be very open to replay attacks unless
some kind of IV was provided since if the server ever displayed
a URL to an attacker, that URL could then be copied, with
signature, to any future user. This woul