如何使用查询身份验证保护REST API

Question

I have a rest API which create by asp.net webservice, and I have an android and IOS application which call the api and show some data to the user.

what I need is to secure my API in a way that only my application can access to the data through the api and other request rejects.

I should mention that my application are not user base so there is no login and authentication and I don't want force user login !!!

According to my search, I need query authentication (query parameters) to achieve this.

What I need is how to create this kind of query parameters and how to validate them? (Performance is too important for me)

Thanks in advance

Answer 1

You can use basic authentication or any token based authentication mechanism. So on every request to your api, get the authentication headers(authenticiation tokens in http request header) and verify if client is allowed to invoke it. If it failed then send by necessary HTTP status code. You just need to ensure that the applications that you want to allow to call your api are using those security tokens in their request headers. And you can keep those credentials or security tokens in memory or file or db as you like.

Answer 2

I am not a security expert, but as far as I know what you want is not possible. Anything you embed on the client to authenticate your application is accessible to an attacker, who can than use that information to access your API.