1

Let's say I have a public Web API, which does not need authorization, like:

public class MobileDataController : ApiController
{
    [AllowAnonymous]
    public IEnumerable<string> Get()
    {
         return new string[] { "One", "Two", "Three" };
    }
}

Is it possible to make this Web API only available for my iPhone and Android native app?

Basically I do not want the Web API to process any request that is not coming from my phone native app.

Tohid
  • 6,175
  • 7
  • 51
  • 80
  • 3
    it sounds like you ***do*** need authorization. – Kritner Apr 21 '16 at 13:36
  • https://stormpath.com/blog/the-ultimate-guide-to-mobile-api-security/ – Kritner Apr 21 '16 at 13:41
  • Kritner - gota read that. I am still wondering if I can do it without authentication. My user doesn't need to authenticate to use the app... – Tohid Apr 21 '16 at 14:07
  • 1
    Maybe from the Request.UserAgent? Ignore requests from a platform you don't want to work with, perhaps? See: http://stackoverflow.com/questions/9734668/how-do-i-detect-user-operating-system – R. Richards Apr 21 '16 at 16:20

1 Answers1

3

No. What you want is what's called device attestation, which is a concept bundled under Trustworthy Computing. However it's impossible, unless you own the device and can ensure it cannot be jailbroken and all communications cannot be intercepted.

No matter what code you add an attacker can reverse engineer it. An attacker can use fiddler to add the headers you send to indicate it's a mobile device. If you use OAuth with client IDs the client ID needs to be inside your software, and thus can be reverse engineered out.

For example, SnapChat doesn't support Windows Phone. There are SnapChat clones for Windows Phone, and the only thing SnapChat can do is to file a takedown notice, as, if they're done well, they're indistinguishable from the real clients running on an iPhone.

blowdart
  • 55,577
  • 12
  • 114
  • 149
  • blowdart - hmmm - Is there anything that we can do it harder for a hacker robot to use our Web API. For example on the web application we use Google Recaptcah to make sure it's a human. Can we do similar thing to an iPhone or Android native app? – Tohid Apr 21 '16 at 17:40
  • Not with any real degree of success no. – blowdart Apr 21 '16 at 18:02