User consistency validation - Mobile Platform as a Service

In high-security data synchronization scenarios, you must verify that the push target is the currently logged-on user and has not been spoofed. Mobile Sync Service (MSS) provides user consistency validation for this purpose. You can enable it as needed. The basic principles are as follows:

When a client connects to the server, it reports the user ID (userId) and authorization token (sessionId). Both values are returned by the user logon system. If either value changes, the client must call the relevant interfaces to re-establish the persistent connection correctly.
The server calls a tenant-implemented consistency validation interface. The tenant uses this interface to control the consistency check, and MSS records the result.
For synchronization configurations with high security requirements, tenants can enable consistency validation so that data is pushed only to devices that pass the check. For configurations without consistency validation enabled, the validation result is ignored.

Configure the consistency validation interface

Configure the com.antcloud.session.validate consistency validation interface as follows.

Important

After you configure the consistency validation interface in the mPaaS console, disable the signature validation feature for the RPC interface. Otherwise, the consistency check logic for mobile synchronization will not work correctly.

Procedure

Log on to the mPaaS console, select the target application, and go to the Mobile Gateway Service > API Management page. Add an API. For more information, see Mobile Gateway > API Management.

Interface name

Set the operationType of the API to com.antcloud.session.validate. The following table describes the request parameters.

Name	Type and length specifications	Required	Example	Description
instanceId	String	Yes	instancedemo	A string in the `workspaceId_appId` format.
userId	String	Yes	20880939	User ID.
sessionId	String	Yes	kkdddd	The authorization token from the client.

Response parameters

Implement the consistency check logic to return data in JSON format. Example:

{
        "resultCode": "OK",
        "resultMsg": "Operation is done successfully",
        "success": true,
        "result": { 
            "sid": "kkdddd",
            "valid":true/false
        } 
}

The following table describes the response properties.

Name	Type	Example	Description
success	boolean	true/false	Whether the service call succeeded. Returns `true` for success and `false` for failure. If the call fails, check `returnCode` for the reason. For more information, see Business result codes.
returnCode	String	ERROR	Result code.
resultMsg	String	SYSTEM-ERROR	Result message.
sid	String	kkdddd	Authorization token or sessionId.
valid	boolean	true/false	Validation result.

Business result codes

Result	Result code	Description
true	OK	The operation is successful.
false	OPERATION_ERROR	An OPERATION error occurred. This applies only to the `com.antcloud.session.validate` interface.