Authenticate Android application requests

Question

I want to develop an Android application in which anonymous users can send requests to my server through HTTPS. I need to make sure that the requests are coming from my app since anyone can craft an HTPP request and send it. This is very critical in my app.

I read about GCM tokens, but I don't know if they can help me in my issue.

Is there a way to authenticate the requests (coming from the app) without hiding secret keys in code (because I read that hiding secrets is a bad practice as de-compilation is very trivial in Android).

Thanks

Answer 1

You can always generate a unique token for your user. And add that token in the header of your request and verify it on your backend.

Answer 2

1. Your server could generate unique PIN for each user of your app and it is then sent to your app and displayed over the app.

2. Users, even though anonymous, are supposed to enter the same PIN before sending the response. In turn request could carry this PIN that server can verify that indeed it has come from the same app.

3. Further you can set timeout for validity of each PIN is valid so that it is not mis-used and always latest PIN generated are used at the end of any session.

One question further to be answered related to point 1: Is how to ensure that this PIN is sent to your app and not to any fake app.

Answer to that will be : For this every app will get unique applicationid when installed on android device. While installation, this applicationid could register with your server in a discreet manner. So this way you ensure that all your API calls are coming from registered app.

Answer 3

I figured out how to solve this issue after following this guide: https://android-developers.googleblog.com/2013/01/verifying-back-end-calls-from-android.html

Basically, You use the GoogleAuthUtil class, available through Google Play services, to retrieve a string called an “ID Token”. You send the token to your back end and your back end can use it to quickly and cheaply verify which app sent it and who was using the app.

When your server receives the token from your Android app, it's really important that you verify it. This requires two steps:

1. Verify that it's really signed by Google.
2. Verify that it's really meant for you.

Thanks.