Security & abuse

Signed responses — do I have to check the signature?

Example Written by the BuildAPI team to answer a common question.
BT
BuildAPI team
Example
Question

The verify response has a signature field. Is checking it actually necessary if I'm already on HTTPS?

BT
BuildAPI team
Example

HTTPS proves you talked to us. The signature proves the answer you're holding is the one we gave, and the nonce proves it isn't one we gave an hour ago being replayed at you.

If the answer never leaves the request that fetched it, HTTPS alone is close enough. The moment you cache it — and you should — check the signature, because a cached answer is exactly what's worth tampering with.