CODEWITHSUNDEEP
phpandroidrestsecurity
Programador Adagal
Programador Adagal

Reputation: 780

Secret token for communicating Ionic App and Laravel RESTful API

I am developing an Ionic App which consumes data from a Laravel 5 RESTful API. All the connections are protected (GET, POST, etc.) by username/pass and user roles, except the user creation.

My first doubt about security is to disallow connections from outside the App, avoiding thousand of user creations, overloading our server resources.

My idea is, when an user installs the app and opens it for the first time, to create a secret token which will be sent in every connection. Then check the device UUID and the secret token to ensure this is an authorized app.

What do you think of securing the connections this way? There is a better idea?

Upvotes: 0

Views: 791

Answers (2)

Darren Lilley
Darren Lilley

Reputation: 404

You need to look a JWT (Jot) JSON web tokens, they will solve the security issue. This can contain user id and other data like access level. Not things like security information or card information.

When a user authenticates Laravel sends them back a JWT which you store in local or session storage this replaces backend sessions.

It is generated by the backend using the parts that can be decrypted by the frontend and using a secret key to encryt the signature, if any of it is tampered with it will fail and deny access.

Every request angular will append the token to the header using a request interceptor and Laravel middleware will decrypt it and allow access to the route they need or return a error code '404' maybe.

If after install this authentication layer you can limit usage at user level on the backend.

But this should sort most of your issues, it a bit of a change in thinking but it does work and it solves a lot of sessions issues you get with ajax calls and it make load balancing easier because all server are looking for a token it can manage.

Upvotes: 1

Fabin Paul
Fabin Paul

Reputation: 1711

I was also encountering the same problems. But after search in google for a while I came to the conclusion that you can put up several walls against hacker, but for someone who is hell bend on hacking your app(ninja hacker) will find ways to use your app in malicious ways. I also came across various ways you can protect your backend server(after google). These step generally make it difficult to use your app maliciously.

  1. You can encrypt strings url using some algorithm and use encrypted string in program ie. https:\google.com\ is encrypted into something like \h09ae\hff00\hebab\h.... then in program String url ="\h09ae\hff00\hebab\h.." This way someone decompiling the app can't find your server backend url. In this case you need to decrypt the string url before you can use it.

  2. Send sensitive data using HTTPS and inside the body of the request

  3. You can verify if request is coming from the device by using google token. For this you will have to use Google API Console. Refer this link for proper android tutorial on this topic.

  4. Lastly, sign key used when you create your apk is unique and ensure that your apk is not tampered with. So generate hash key of your sign key before it is upload to google play and save it in your server and programmatically get hash value of sign key and send it with very request to your backend.

Hope is helps you..

Upvotes: 0

Related Questions