How to prevent access to my server by unauthorized clients

Question

I have an android application. The application reads data from my server and displays them to the user.

Now, the question is: How to prevent someone from making a bogus app and asking my server to send data to this app?

This wastes both my bandwidth and makes use of my content while allowing people to create competitive apps using my data.

As you know, trying to prevent reverse engineering is like trying to stop piracy: impossible. Android reverse engineering especially it's like stealing candy from a baby.

When connecting to a database, you should have a username and password set up to access it. — epsilondelta, Jan 04 '14 at 16:22

score 5 · Accepted Answer · edited May 04 '19 at 22:30

Use API Tokens. Possible solutions:

HTTP Basic Auth example (only if you are using https)
Query Paramter (like https://example.com/resource?token=3786428762) (also only over https)
HMAC - sophisticated and more complex to implement, requires substainsial redesign of the backend communication, but the most secure

But mind you, either way you need to somehow hardcode a key/salt/hash/password in your app which can be reversed engineered one way or the other. There is no real (practical) possibility in Android to avoid rogue clients from accessing your backend (especially in rooted devices).

I would recommend HTTP Basic Auth since it's the best tradeoff in effort, usability and security (It's also used by the majority of public apis) It's very easy to implement since you only need to send a hardcoded http header, it's supported by practically every http server and it does not change your API and pollute it with query parameter and it's also reasonably secure if used over https.

It uses multiple secrets and signs the whole message. For details see the wiki link provided in the post. — Patrick, Jan 04 '14 at 16:44

score 2 · Answer 2 · edited May 23 '17 at 12:33

2

Make the server require an API key and obfuscate the key in your code, see this answer: Best Practice for storing private API keys in Android

edited May 23 '17 at 12:33

Community

1
1

answered Jan 04 '14 at 16:22

Steve M

9,296
11
49
98

score 2 · Answer 3 · answered Jan 04 '14 at 16:24

2

If you use http server, you can use http auth basic

Basic access auth

answered Jan 04 '14 at 16:24

jacknad · Answer 4 · 2014-01-04T16:29:16.343

1

You could use something like reCAPTCHA to verify that the client is not a bot.

edited Jan 04 '14 at 16:29

answered Jan 04 '14 at 16:22

jacknad

13,483
40
124
194

How to prevent access to my server by unauthorized clients

4 Answers4