仅通过受信任的 Android、iOS 和 Web 应用程序访问 Azure APIM

Question

We have Android, iOS and Azure Web app for our system which will be calling Azure APIM which is created for Azure API APP.

Problem statement is : APIM should only be accessible via Android, iOS and Azure Web app, for other clients like postman or any different mobile app or web app, APIM should give access denied error. We need a solution where header should not be passed from any of our trusted clients as this can be exploited and APIs can be called via third party clients like postman etc.

Answer 1

There is not much you can do from web and end user devices. In web apps you can't safely authenticate client app, since traffic and all secrets you may want to use are visible to a user. It's a bit more safe in Android and iOS, but event there phone may be rooted or jailbroken.

So I'd advise against relying on app secret, rather think about authentication user itself. Much like any other web app works where user obtains a token and uses that token to access API. Since it's a user level token it's safe to expose it to a user. Look into OAuth. If you want to use JWT tokens APIM has validate-jwt policy to check them.