How to limit the web content to be view/consume by specific iOS and Android Apps?

Question

I am building a web-based platform using ASP.Net for server-side and have iOS and Android apps for client-side. The apps can consume contents from the server via .ashx. Now the problem is, if someone know the URL of the .ashx files, they can consume the content as well. But we want the content can only be viewed by our apps.

I have an idea that if ASP.Net can read the AppID of the apps, then the server-side can check or block the content for the whitelisted AppID. But how to get this information? Or is there any ways to limit the content?

Answer 1

You could add a header to your GET request from the iOS or Android app. If the users have a specific username/password this could be a some type of "cookie". If not you could just pass a magic value.

x-magic-value: SomeFixedStringOfLetters

If a user attempted to visit your url from a regular browser, they would lack the header and your server could response with a 401 or 404.

You should implement this with SSL (HTTPS) so that anyone sniffing the request could not see the cookie or magic value.