Important data such as user name and password need to be encrypted, so that even if they are caught monitoring, they don't know what the original data is (if it is a simple md5, they can be violently cracked), so the more complicated the encryption method, the safer it is. If necessary, md5 (irreversible) and aes (reversible) are common. You can add some special characters, but you can't do it without thinking.

Non-important data should be signed, and the purpose of signing is to prevent tampering, such as /getnews? Id= 1, get the news with id = 1. If you don't sign your name, you can get the content of 2 through id=2, and so on.

How to log in? Http is stateless, that is, the server cannot judge whether two requests are related. Then, after logging in, how will the future interface judge whether to log in or not? Simply put, a token field (with any name) is stored in the database. When the user successfully calls the login interface, a value (such as aes (expiration time)) is set for this field and returned to the front end. In the future, the front-end request will bring this value, and the server