Authenticate HTML5 application wrapped with Phonegap (or equivalent)
android, cordova, ios, javascript, security
Solution
An application is a piece of software, not a tangible object. The only way to authenticate it is if that piece of software contains a secret of some kind. From the server, to authenticate a client, you request that the client demonstrate that it knows the secret.
If you allow anyone to download your application, then whatever data it contains is not secret. So you cannot authenticate your application.
What you can do is make the secret harder to extract, with obfuscation techniques. Obfuscation done right is very hard — adding man-months to your development effort if they're to have any benefit. If you can still use a debugger, you're doing it wrong. Obfuscation done wrong means wasted effort. Obfuscated effort means adding days or weeks of work for someone to extract the secret. You need to ask yourself whether it's really worth it. Fundamentally, obfuscation is hiding the key under the doormat. Or behind the flowerpot if you're feeling fancy.
See also some similar questions on Security Stack Exchange: How to store a private RSA key for an application?; Storing private asymmetric key in application binary?
Problem
Is there a way, using JavaScript only (client side), to ensure that an HTTP request is actually coming from my Phonegap application? Be aware: I'm not talking about authenticating the user, rather, in a sense, about authenticating the app itself. There isn't (and mustn't be) any kind of user interaction related to this. Not even talking about confidentiality of the communication (I'm not using HTTPS and the payload is not encrypted). My guess is, in the end, this inevitably requires some sort of hard-coded key. The problem is, as you can see for example here, such a key would be usually accessible by almost anyone - and this problem comes up not only with Javascript assets, but also with Java in Android. If no way with Phonegap or any Cordova plugin, could you suggest an equivalent framework (or environment like Icenium) that could make this thing possible? Or, at last, would there be any real risk in not taking this precaution for the aforesaid scenario? EDIT: Kurt Du Bois reminded me I did not mention SSL client authentication. Be it applicable/convenient or not, it always ends up to the problem of keeping a private key secret. I find this is well described here, and summed up in the sentence: "the assurance that the key hasn't been exported is only as strong as the key store itself".