User consistency validation - Mobile Platform as a Service

Some business scenarios require high security for data synchronization. You must ensure that the target user for a push is the same as the currently logged-on user and has not been spoofed. MSS provides a user consistency validation feature to meet this requirement. You can enable this feature as needed. The basic principles of this feature are as follows:

When a client connects to the server, it reports the user ID (userId) and authorization token (sessionId). The user logon system returns both the userId and sessionId. If the userId or sessionId changes, the client must call the relevant interfaces to ensure the persistent connection is established correctly.
The server can call a consistency validation interface that the tenant implements. The tenant uses this interface to control the consistency check. MSS records the result of this check.
For synchronization configurations with high security requirements, tenants can enable consistency validation. Data is pushed only to user devices that pass this validation. For configurations without consistency validation enabled, the validation result is ignored.

Configure the consistency validation interface

This section describes how to configure the com.antcloud.session.validate consistency validation interface.

Important

After you configure the consistency validation interface in the mPaaS console, disable the signature validation feature for the RPC interface. Otherwise, the consistency check logic for mobile synchronization will not work correctly.

Procedure

Log on to the mPaaS console, select the target application, and go to the Mobile Gateway Service > API Management page. Add an API. For more information, see Mobile Gateway > API Management.

Interface name

Set the operationType of the API to com.antcloud.session.validate. The request parameters are as follows:

Name	Type and length specifications	Required	Example	Description
instanceId	String	Yes	instancedemo	A string in the format of `workspaceId_appId`.
userId	String	Yes	20880939	User ID.
sessionId	String	Yes	kkdddd	The authorization token from the client.

Response parameters

Implement the consistency check logic to return data in JSON format. The following is an example:

{
        "resultCode": "OK",
        "resultMsg": "Operation is done successfully",
        "success": true,
        "result": { 
            "sid": "kkdddd",
            "valid":true/false
        } 
}

The properties are described as follows:

Name	Type	Example	Description
success	boolean	true/false	Indicates whether the service call is successful. Returns `true` for success and `false` for failure. If the call fails, check the `returnCode` for the reason. For more information, see Business result codes.
returnCode	String	ERROR	Result code.
resultMsg	String	SYSTEM-ERROR	Result message.
sid	String	kkdddd	Authorization token or sessionId.
valid	boolean	true/false	Validation result.

Business result codes

Result	Result code	Description
true	OK	The operation is successful.
false	OPERATION_ERROR	An OPERATION error occurred. This applies only to the `com.antcloud.session.validate` interface.