有人可以破解 React Native 或任何传统 JS Native 应用程序的 API 调用吗

Question

Let say i have a post api call like this

fetch('https://mywebsite.com/endpoint/', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    firstParam: 'yourValue',
    secondParam: 'yourOtherValue',
  }),
});

can some one decode this android react app via dex2jar and something like this and snipe the apis calls..

how can we secure the api calls via server side auth and also from snipping

Answer 1

Yes it is possible, since your browser will show each call done by your app, using chrome you could openthe chrome dev tools and have a look at the network tab.

However there is many way to protect this (you cannot hide it, but you could definetly protect it from unwanted access), probably the most popular are this two :

• Cors
• Authorization Header `

Answer 2

Plus someone can always open up the app and take a look at you MAP file and get your keys as well.