CODEWITHSUNDEEP
phpjavascriptjqueryhtml
TauWich
TauWich

Reputation: 905

How to allow only certain devices to access web site

We are developing in-house web-based application for viewing data reports while targeting on smartphones and tablets. Our customer asked us for possibility that only certain devices could access the content. Hence we use technologies based on javascript/HTML5 we are no capable of reading unique ID like IMEI or device uuid. On the other hand side we could use server technologies like ASP, PHP to gain success.

I have several ideas which dont lead to wanted result (one discussed here: Persistent client-side web storage).

I wonder if you have any idea that allow only certain devices to access web site?

Upvotes: 3

Views: 8394

Answers (3)

tmh
tmh

Reputation: 1445

Such access control would only be "secure" if a traditional login method is implemented on top of it, i.e. users (1) need to sign in with username and password, but (2) they can only do so on specific devices.

Step (1) is required to make access basically "secure", while step (2) would only make it just a little harder to break into your app for people who have hardly a clue what they're doing.

(Without the second step, people could attempt to brute force the login form when they know its URL, without sniffing any other network traffic.)

You could certainly fingerprint the user agent (UA) string and possibly other HTTP headers, assuming the mobile browser app isn't constantly updated and therefore doesn't constantly change its UA string (that could be a hassle), and check server-sided.

Your could also create a simple, really simple native mobile app for the target platform(s), consisting only of the platform's default web browser widget, with your app's URL built-in as the default page.

You could then control the URLs and possibly HTTP headers, and add special, secret authentication headers or URL parameters (e.g. device's IMEI), for which you check on the server side.

If you target Android, you don't necessarily need to rely on Google Play; you can also distribute the APK files from one of your own servers, making the app available only to the intended audience.

Upvotes: 2

BrownEyes
BrownEyes

Reputation: 2287

Try the lightweight php-mobile-detect here: (server side checking is always better) https://code.google.com/p/php-mobile-detect/

Upvotes: 0

nl-x
nl-x

Reputation: 11832

AFAIK you only have the User Agent to work on, with maybe some Javascript values that you can return as are used when fingerprinting.

The User Agent should give you a lot to go on, but it can easily be spoofed. And so can the Javascript values.

I don't think there is a secure way to do what you want. But then again, I don't know if you really want it that secure.

What you also could do is to not do it 100% browser based, but create a mobile App. (Such as in Apple AppStore / Google Play Store) Here I think you can request access to more variables to identify the machine type.

Upvotes: 2

Related Questions