android app和server之间的客户端服务器通信

Question

I am building an android application which communicates with web server for authentication, and getting data from server. I am using HTTPS/SSL for communication using self signed certificate on the server and allowed that certificate in the android app . In this way i am sure that I am talking to a correct server. But how to make sure that server is getting a request from the right client.

What if I spoof the http request from the browser to send to server ?

How can server know whether it is getting request from the android application , is there any way to restrict server from handling requests only from the mobile app ?

Answer 1

That's a complex problem.

You could have a private certificate and its corresponding public certificate signed by a CA recognized by your server (just add the CA public certificate in the corresponding key store). The main complication of that solution are: -Somebody can steal the certificate and use it in another device (if this problem is negligible for your application, then this solution is OK) -Certificate distribution and expiration: you need a solution for bootstrap, certificate distribution, and actions before certificate expiration.

Other solutions could involve having a Device ID, there are some providers for this, and using One-Time Password.