CODEWITHSUNDEEP
android
Eric
Eric

Reputation: 1775

How to secure Android-php connection?

I'm building an Android application which has to sent some information to my mysql database. The mechanism I'm trying to implement is based on JSON, php, Mysql combination. Unfortunately I'm not a veteran when it comes for those subjects. As I understand correctly the php-Mysql connection is always secure - nobody except me can see the source of php script in which I have written username and password to my database. Now the tricky part, my php script is located on Apache server and it isn't protected at all, therefore anybody can trigger it (even from the desktop browser). How can I prevent this situation? and how can I safetly trigger my php script from my Android device? Thanks

Upvotes: 1

Views: 5074

Answers (4)

Dolev
Dolev

Reputation: 86

  1. Use ssl, this will encrypt the connection
  2. Set an authenticate mechanism, on your php page and you android application will send the credentials
  3. Set a random pin code that the server side sends to the application, and he is valid only to the current session, and the application need to run a function that will generate the right answer to this current number and sends it to the server as verification, for example if the server sends me the pin number:120, and the verification function of mine is to +1 the pin number I will send the server 121, but I suggest to use a little bit more complicated algorithm.

Upvotes: 4

kgiannakakis
kgiannakakis

Reputation: 104168

The Android device is no different than any other HTTP client, like your browser. You need to follow the same mechanisms you will be using in order to protect a standard Web Page:

  • Require login to the page. The user needs to supply a valid username and password to gain access. The server returns a session, which is usually stored in a cookie. This question will help you on how to do that on Android.
  • To keep someone from intercepting the username and password, the log-in should be done over HTTPS

Upvotes: 1

Abed Hawa
Abed Hawa

Reputation: 1362

the most intuitive way is to authenticate the user (Username + Password) using an Https Connection, there is better types of secure authentication like OAuth, see this: http://code.google.com/p/oauth-signpost/

Upvotes: 0

Edison
Edison

Reputation: 5971

  1. Use SSL. This will encrypt the connection between the device and the server.
  2. Use a client id/key for your device that is verified on the server.
  3. In case you REALLY worry that someone will modify your app to send fake calls using such: verify the client certificate as well (piggy back). (The same way it is done with Facebook Android library and Google mobile libraries).

Upvotes: 5

Related Questions