如何使用用户代理仅允许访问特定移动应用程序的网页

Question

I have created some php web pages for inserting webview & some json informations in an android app. And I want to protect my web data by allowing access to these web pages ONLY from my app , how is this possible ? I heard that this can be done by setting my own user agent in the app and catch it in my web page , but I don't know how to do this

Answer 1

Assuming that the connection between your app and the backend is via HTTPS, you could use client-side certificates to authenticate the caller (your app) to the backend server. Only if the caller provides the right certificate the transaction could move further.

Note that this is not unbreakable: someone who has access to your app can extract the certificate and replay it. This is not obvious to do so if you want a reasonable but not NSA grade solution it would be acceptable.

A simpler solution would be to send a hard-coded authentication token as part of the transaction, checked by the backend.