Storing URL in Android

Question

I am trying to access my mysql database through PHP. I have the URL and things are working fine but my question is: which is the best way to store the URL in the project? I thought Strings.xml is safe to store all kinds of URL but then realized strings.xml can be decompiled to get the URl easily.

What / where is the best way to store the URL in my android?

Thanks!

Use encrypted form in strings.xml or make parts of URL & combine it in code. — Raj Shah, Aug 21 '15 at 10:44
@GauravVashisth: I trying hide it because the URL contains the API to access my mysql data. — TheDevMan, Aug 21 '15 at 10:49
@GauravVashisth: URl is already doing that... but then I want to be safe. — TheDevMan, Aug 21 '15 at 10:52
Rajesh ji, shared preferences can also be easily seen, if data is in plain text. — Gaurav Vashisth, Aug 21 '15 at 10:53
@FrankN.Stein Will `common user` decompile applications to see what's inside the `strings.xml`? :) — Sergey Glotov, Aug 21 '15 at 11:09
You could store the URL in a picture, by using **steganography**. — Phantômaxx, Aug 21 '15 at 11:10
Security by obscurity is not really going to work well. You can't reliably "hide" anything (anyone can decompile your code) and your best bet is to make sure your PHP service is secure and authenticates requests. Other than that, you're relying on a very weak "security model". It shouldn't matter if people can find out everything about your API as long as it's secure. — kha, Aug 21 '15 at 11:15

score 2 · Answer 1 · answered Aug 21 '15 at 10:56

2

Everything is useless, URL can be easily seen with proxy even if you use proguard or string encryption or HTTPS. You can't hide it. You only can add authentication to protect data.

answered Aug 21 '15 at 10:56

Sergey Glotov

20,200
11
84
98

URL is protected but doing you think All Online Store APPS are doing the same... as just put them on strings.xml – TheDevMan Aug 21 '15 at 11:01
I don't know about all apps, but I think there isn't much sense to hide urls. – Sergey Glotov Aug 21 '15 at 11:08

score 1 · Answer 2 · edited May 23 '17 at 12:22

1

I don't see much advantage in hiding/obfuscating URLs as urls could easily be seen through network tools. but

So, If you want that some one can not easily decompile and see any string you are saving, you can obfuscate the code. Some options include

Use dexguard https://www.guardsquare.com/dexguard. It is made by the same developer (Eric) who also developed proguard.

OR

Obfuscate yourself cleverly. Something like Simple hiding/obfuscation of strings in APK?

edited May 23 '17 at 12:22

Community

1
1

answered Aug 21 '15 at 11:02

Gaurav Vashisth

7,547
8
35
56

Or store the URL in a picture, by using **steganography**. – Phantômaxx Aug 21 '15 at 11:09

Amey Shirke · Answer 3 · 2015-08-21T11:13:19.457

0

1.Store them as String constants public static final in a separate class if they are not going to change.

Store them in android:tag

Tags

Unlike IDs, tags are not used to identify views. Tags are essentially an extra piece of information that can be associated with a view. They are most often used as a convenience to store data related to views in the views themselves rather than by putting them in a separate structure.

android:tag="www.xyz.com"

and get using view.getTag()

Note: The above are the few ways of storing URLs in android but from security perspective as I commented below you should look to secure your APIs on server side instead of worrying about hiding on client side as everything can be decompiled.

edited Aug 21 '15 at 11:13

answered Aug 21 '15 at 10:44

Amey Shirke

599
1
5
16

I was actually browsing through google figured out there lot of website they can decompile APK and give the exact project. So will constant help me? – TheDevMan Aug 21 '15 at 10:46
classes can also be easily decompiled. – Gaurav Vashisth Aug 21 '15 at 10:47
1

Yes, but you can use Proguard and make things difficult: http://developer.android.com/tools/help/proguard.html – Amey Shirke Aug 21 '15 at 10:50
@RajeshJadav: How do I that to store to sharedpreference I have to give details of URL.. – TheDevMan Aug 21 '15 at 10:54
@TheDevMan Everything can be decompiled if spent enough time. You should be more worried about securing your APIs on server side. – Amey Shirke Aug 21 '15 at 10:57

Storing URL in Android

3 Answers3