如何保护 web API 数据？

Question

I have a web server with API in PHP and clients applications in Python.Client application sends an request to the server with informations like what OS is client using or what services are running on his computer. The HTTP POST request can look like:

POST http://www.example.com/users/info

And POST data like:

{
  "os": "Windows 10",
  "services": [
    "chrome.exe",
    "firefox.exe",
    "calc.exe"
  ]
}

I want only my application to be able to send that requests. How can I secure this data against self user manipulation?

Im using HTTPS requests to protect data but Im sure its not enough.

Answer 1

If the application is in Python, and any user can read the source code, then anyone who knows Python - and has access to the source code - can spoof requests to your server.