How to prevent access to my server by unauthorized clients
android
Solution
Use API Tokens. Possible solutions:
- HTTP Basic Auth example (only if you are using https)
- Query Paramter (like https://example.com/resource?token=3786428762) (also only over https)
- HMAC - sophisticated and more complex to implement, requires substainsial redesign of the backend communication, but the most secure
But mind you, either way you need to somehow hardcode a key/salt/hash/password in your app which can be reversed engineered one way or the other. There is no real (practical) possibility in Android to avoid rogue clients from accessing your backend (especially in rooted devices).
I would recommend HTTP Basic Auth since it's the best tradeoff in effort, usability and security (It's also used by the majority of public apis) It's very easy to implement since you only need to send a hardcoded http header, it's supported by practically every http server and it does not change your API and pollute it with query parameter and it's also reasonably secure if used over https.
Problem
I have an android application. The application reads data from my server and displays them to the user. Now, the question is: How to prevent someone from making a bogus app and asking my server to send data to this app? This wastes both my bandwidth and makes use of my content while allowing people to create competitive apps using my data. As you know, trying to prevent reverse engineering is like trying to stop piracy: impossible. Android reverse engineering especially it's like stealing candy from a baby.