CODEWITHSUNDEEP
phpmysqlcordova
Merijndk
Merijndk

Reputation: 1693

How can I make sure only my phonegapp ajax posts will be executed by php

I am trying some stuff out with phonegap and I had a question concerning the security that I cant figure out.

So lets say I want to add something in a db. I let phonegap do an ajax post to a php file on a server with the vars and this php file will insert it in the db.

But anyone who would know where this php file is located and knows the data it wants can do an ajax post and insert data right?

I was reading about giving the php api a token. But I also was reading it is very easy to decompile a phonegap apk so it wouldnt be hard to get this token right?

So how can I make sure the php file on the server only accepts posts made from my phonegap app?

Upvotes: 0

Views: 39

Answers (1)

AndySavage
AndySavage

Reputation: 1769

You can't. There is no way to guarantee they only come from your application. You can however ensure any calls come from a specific known user of your application.

You have an untrusted client with which it is impossible to embed a secret within without compromising the secret. You can make it harder, such as encrypting your JS and packaging it encrypted, then relying on Apple's DRM to secure your key, but for someone vaguely determined that will not stop them. Your AJAX end point exists and as the insecure client needs to communicate with it somehow there will always be a way to discover the client's secret.

However, typically this isn't an issue. What you can do, is exchange a secret with the client that is tied to a single user so that any calls to your API are on behalf of that user, and that user only (presuming that secret is kept secure - they don't lose their device etc). You can then use this secret to either encrypt or sign your outgoing AJAX call. This ensures someone can only affect their own account (e.g. only update their own account, only upload content tied to their account etc), and can't make arbitrary calls on behalf of other users.

This is enough for many types of application - though you haven't provided any detail about what your AJAX call does. No one is going to deliberately leak their own "personal" secret (though if theft is a concern, or you have higher security requirements then you could implement 2FA or more).

Personally, if this was anything non trivial, I wouldn't advise rolling your own system anyway. Security is difficult to get right, and there are many existing authentication systems out there (e.g. OAuth2) which have been tried and robustly tested in the wild.

Upvotes: 1

Related Questions