如何防止Android应用程序中使用的文件的直接URL访问？

Question

I have an mp3 file in a server, Example: www.example.com/Album/Songs/abc.mp3.

I am building an android app to list all files under 'Songs' folder and then play the selected ones.

Now, is there a way to prevent direct access to the mp3 file incase if someone gets hold of the URL?

I tried the usual methods like rewrite engine. It prevents direct URL access but it also blocks my app from using the files.

Here's my android code to play the files:

            MediaPlayer player = new MediaPlayer();
            player.setAudioStreamType(AudioManager.STREAM_MUSIC);
            player.setDataSource(song_path);
            player.prepare();
            player.start();

The song_path is simply http://www.example.com/Album/Songs/abc.mp3

PS: I understand that encrypting through ProGuard will make it nearly impossible to get the direct URL through reverse engineering. I still wanted to check if there is any other way to make it work.

Answer 1

there is nothing you an do about it in your android app. its a policy the server side should take to prevent this. even if you proguard your APK there apps like wireShark which can sniff your app and find what APIs you are calling.

there are some ways to do this. some try to generate temprory links whenever the app (with a user that is logged in) calls a say play API they provide the app wit ha temporary link that will invalidates some minuets (or hour) later. then app uses that link to play the music or whatever.

another scenario is to encrypt the music bytes and decrypt in the application side that has more complicated considerations.

Answer 2

You can use player.setDataSource(Context context, Uri uri, Map<String, String> headers) to send a custom header . You can then check for that custom header in PHP or in Apache before returning the mp3.

To check in Apache, you would use a rewrite rule to check for and allow only connections with the correct header .

In PHP, you could use $_SERVER['HTTP_*YOUR_HEADER_HERE*'] and then echo the MP3 file along with the correct headers. Might be a bit tricky if you allow seeking.

The Apache rewrite rule may be the easiest to implement.