CODEWITHSUNDEEP
apirestoauth-2.0django-rest-framework
blue_zinc
blue_zinc

Reputation: 2500

How to restrict API endpoint access to certain clients?

I'm building an API using the Django Rest Framework.

I've looked at a whole bunch of documentation, however I can't seem to answer this:

How can I restrict my API such that only my iOS client can register users / log them in?

I understand that I can use OAuth2 or Token Authentication for additional endpoints. But for unauthenticated requests, is there any way of restricting them?

Upvotes: 3

Views: 5591

Answers (3)

鄭元傑
鄭元傑

Reputation: 1647

I also encounter this issue.I would like to provide some of my thought.

My team would need to support some APIs with heavy operation and it would be open to unauthenticated users which is design by business logic.
That's why we need to restrict api requests to our app clients.
The API call is stateless and irrelative with caching and proxies.

In the other hand, some malicious attack like CSRF, you should also provide some additional protection on you API to prevent request sending from untrusted way.

There are several mechanism we considered.

  1. Using HTTP header
    This is untrusted and very easy to crack.

  2. Use one static random generated API Key
    Very common and easy-implementation way. Server generated one static random string as key and client must carry when sending request.
    If you have to support web, this would be leak by web console.But if you only support app client and restrict your API connection with HTTPs. This should be safe enough.

  3. Dynamic change API key with AES crypto algorithm
    To prevent MITM or static API key is leak, I proposed to use AES crypto algorithm and encrypt current timestamp.
    When server receive, decrypt and check whether the request is valid or not.
    You can also append some string as salt to make the mechanism harder to brute force attack.

You can do as much effort to make it harder to crack, but it would never be absolutely 100% safe.
Hackers can still reverse engineer your app to see how the encryption works.
All you can do is making it harder.

This is my propose and hope it could inspire you.
If you have any other better solutions or find some bug in my proposal, please let me know.

Upvotes: 2

mahemoff
mahemoff

Reputation: 46419

There's no truly secure way to guarantee requests are coming from a specific device. Checking headers seems like the best way, as mentioned by @dukebody, but should be considered as a "good enough" solution for most users.

I'd also question why you want to do this. APIs generally shouldn't be restricted to certain devices because it makes them less extensible. Moreover, REST/HTTP services should return the same result regardless of the client device; otherwise, you will cause headaches when dealing with caches and proxies between clients and your service.

If you are trying to format content specifically for iOS, you'd be better off adding a specific parameter like ?format=ios without checking headers, then just make sure your iOS client uses that param. That would be more in the spirit of REST and make things easier to cache as well as test.

Upvotes: 3

dukebody
dukebody

Reputation: 7185

Restrict the views to the user agent of the iOS client, checking the headers. See https://stackoverflow.com/a/4617648/356729

Upvotes: 0

Related Questions