How can I restrict my Azure Web App API access to only my Xamarin.Forms app?

Question

I am quite an experience Xamarin developer but completely new to backend stuff. I have written an API which has some data, let's say weathers, which my Xamarin.Forms app will query. All the calls are GET calls so no issues with security but I'd like to restrict the API so that only my app is authorised to make those calls. This is to prevent some other wily developer building their own app that calls to my API for example.

I understand having done some research that the best way would be to have users log in to my app and then authenticate via Azure AD. However this is pretty cumbersome for a lightweight app where security is not really an issue and no individual user data is passed.

Does anyone have a genius example of how this could be done? I found this article pretty useful but it didn't really give a solution. I accept that this is not the most secure method but really it's a risk/reward/effort thing and I'd just like to make it a bit more difficult than at the moment (I'm basically hosting a very nice public API.!).

Thanks for your help!

Will

Answer 1

Where there is a will there is a way.

You can do some basic filtering that will stop some people, but if there is no authentication from data that's stored outside your application, then there is a way to mimic your application and use your API in a potentially unintended way.

This StackOverflow answer is a little bit more in depth, but echoes the same point.