防止通过浏览器直接访问图像/pdf，但只允许通过 android 应用程序访问

Question

I am trying to show images in an Android App which are stored on a Webserver. The images should not be available over a direct link in the webbrowser. The image name is a random generated hash string. It should only be accessible in the Android App.

Is there a was to protect the Image from access through the webbrowser or other access except from the Android App? I did some research, but did not find a good solution.

Answer 1

You can make it slightly harder, you can't make it impossible. In the end, there's no way to know whether an incoming request is actually coming from a particular app, or if its coming from something pretending to be a particular app. The two look identical. There are two things you can do however:

1)You can make sure its sent by an authorized user. Basically the user has some secret that he tells to the server and the server checks that secret is valid and if so allows access (and if not returns an 404 or some other error). This is your basic login type system (the exact implementation tends to be a bit more involved, I'm simplifying). But if you do this you can't be sure it isn't someone with an account accessing through the app or through a web browser or tool like curl. All you know is that the person has permission.

2)You can put that secret into the app itself, and send it as a header with every request. This is trivially hacked to get the secret, but 99% of people wouldn't bother to. It's a speed bump to anyone who wants the data that would take a skilled hacker 10 minutes to break.

Neither of these do what you want. #2 has the advantage of keeping out casual web crawlers without requiring much effort. #1 has the advantage of actually securing it to authorized individuals. Depending on what you need either can be a "eh, good enough" type solution.