CODEWITHSUNDEEP
security
eltitano
eltitano

Reputation: 3

How to secure my API against "fictitious" payload?

I have developed an app for Android/iOS which calculates a value based on the users input. If an event occurs, this calculated value will be sent to my Backend as normal HTTPS payload. My question is now, how can I make sure, that this value is really only calculated by the source code of my app? Is there a way to handle such a problem?

To make it clear: I want to avoid, that somebody is rooting his phone, extract the Auth-Token from the private storage of my app and sends a valid HTTPS-Payload to my Backend with fictitious payload, manually or by manipulating the source code.

From the view of the backend, it's difficult to evaluate the payload based on its values if it is valid or not.

Any suggestions appreciated!

----------EDIT-----------

For the sake of completeness: apart from the answers here, the following are also very interesting:

Where to keep static information securely in Android app?

How to secure an API REST for mobile app? (if sniffing requests gives you the "key")

Upvotes: 0

Views: 352

Answers (2)

gplumb
gplumb

Reputation: 760

Short of doing everything on the backend, you can't very easily.

I'd recommend some reading around CSRF (Plenty of articles floating around) as that's at least a good mitigation against bots outside of your app domain hitting your backend. The upshot is that your application requests a unique, random, identifier from your backend (which ideally would be tied to the user's auth token) before submitting any data. This data is then submitted with your app's data to perform the calculation on the backend. The backend would then check this against the random identifier it sent for that user earlier and if it doesn't match, then reject it with a 400 (Bad Request), or 404 if you're paranoid about information leakage.

Upvotes: 0

Scott McNeany
Scott McNeany

Reputation: 572

You can’t trust data coming from the client. Period.

You should consider moving the calculation logic to the server and just sending the raw values needed to perform the calculation. You can easily get sub-second response times sending the data to the server, so the user won’t notice a lag.

If you need offline connectivity, then you’ll need to duplicate the business logic on both the client and the server.

Upvotes: 1

Related Questions