如何防止本地客户端访问我们的API

Question

We have a PHP REST API and an angularjs client.

We don't have and won't have any native clients, only the browser.

an attacker has made a fake website with fake accounts doing all payments with it and we're on the goal to prevent that.

Now we found a way to prevent a website server from accessing our API and the browser can't make the cross-domain request but nothing prevents an attacker from making a desktop app that accesses our API.

How to detect that the client is a browser and not a native client ?

PS

I know that browsers can be embedded in desktop apps and for now I'm ok with that, just not a pure native client.

Answer 1

The only way to achieve this result is to do a challenge-response mechanism with Javascript so a "native client" would have to parse and evaluates the result, which is difficult without embedding a browser or Javascript V8 engine.

Just print in the JavaScript a token by PHP and then JS would have to do cryptographic calculations. More is polymorphic more it will be difficult to implement an automated bot without an embedded browser.

However, you cannot stop a native application with a JavaScript interpreter like V8 engine by google (which is heavy in size but really fast)