Detecting http request from a mobile app

Question

How can one detect an http request came from a mobile app?

One option might be adding a input parameter and send it with the http request, but anyone would be able to easily fool the Web service into thinking the request came from a mobile app.

Answer 1

You can try implementing SSL (we currently use mutual SSL in our apps). Another option would be to use existing Google Play Services to verify back-end calls from apps .

Answer 2

you can check request headers for the user-agent. but even that can be manipulated.

Answer 3

In case your service provider can't provide you with SSL infrastructure, you can make a hash string that came from some information sent in the request. For example, you could create a hash from the request's body, the URL, the method, and maybe some user access token or API key.

If you know how that hash is created in the client, you can recreate it in the server side and compare it to the hash your mobile app sent. Given that only you, the developer, knows how that hash was created, no one will be able to fool it.