Block non-Android users calling JSON service

Question

My Android application calls the JSON service via HTTP, and I would only like to allow my application to call the service and block others.

What is the best way to do this?

One way I can come up with is to use private / public key encryption. Can we safely inject the secret key into the application?

Answer 1

Include some hidden certificates / credentials in your application, different for each downloaded application. Then use them for authentication. Even then it can be easily abused, however you have created your first line of defense.

After that, try to set restrictions on the ratio in which one client can request, throttle and blacklist as necessary based on IP, credentials, etc.

Answer 2

The easiest way would be to use HTTPS with authentication.

Edited by:

The question is not how to protect access to the servers, but how to hide / protect credentials (passwords / certificates / etc.) on Android phones. The question should be: how to hide data in Android applications.

One solution is to use an obfuscator such as ProGuard .

Answer 3

Once you distribute your application, it can be taken apart. In this way, the private key that will be distributed with your application can be retrieved and reused.

There is no completely secure way to do what you are trying to do. But there are ways to limit customers, even if they are not reliable.

The simplest (and least secure) is user agent-based access restriction. But any client can fake a user agent.

The certificate / cryptography solution is more reliable, but as mentioned above, the certificate can be extracted from your application.

OAuth is used by some applications in the same context as yours. But OAuth was not intended for desktop (or mobile) applications, and was also vulnerable to reverse-engineering an application.

You can authenticate the user (via user / password or other standard method). In this case, you are not limited to the base on the shape of the plate. Then you can close the account of users who abuse your service. This is a safe solution, but not quite the answer to your problem.