如何在后端验证请求

Question

I'm creating a payment android library( aar ) and i have to make sure that all of the requests that i got in back-end are from my lib not a fake lib.

how can i do it?

Answer 1

I used two ways before:

1- Easy and bad way: Try to use a hardcoded String like JWT in your app and use a strong obfuscator to avoid decompiling the application.

2- Better way: You can use instance id and send it to your backend and server can inquire this id from the Google and there are some elements like package id in the response which server can use to accept or reject the request.

A sample response from the Google:

{
  "application":"com.iid.example",
  "authorizedEntity":"123456782354",
  "platform":"Android",
  "attestStatus":"ROOTED",
  "appSigner":"1a2bc3d4e5",
  "connectionType":"WIFI",
  "connectDate":"2015-05-12
  }
}

reference: https://developers.google.com/instance-id/reference/server