1

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer an app's .apk file to get the java code containing the REST credentials.

So I'm wondering if there are ways to secure the credentials against reverse engineering revelation?

  • it the same situation as client-side JS, where you have to use a server you control to talk to the API using your credentials, then echoing back the response to the app. in this way, the app doesn't have the keys, only the "proxy" server. – dandavis May 30 '16 at 3:03
  • 1
    you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. – Neil McGuigan May 30 '16 at 3:30
2

The best practice is to not store the access credentials within the program. Apps do not always contain (unless they are badly designed) any specific credentials within themselves to access the API.

While adding credentials into the code may deter general attackers it will not stop attackers who can open up the package and extract the details. As something that can be cracked by a few is considered vulnerable too the right way to implement it would be as follows.

  1. Add not credentials into the APP
  2. When the APP is installed generate credentials and register with the server. (could be username and password or could be a client side certificate)
  3. Obtain an access token using these credentials.
  4. Use the access token to access the API

As you can efficiently control the registration process and can permit access to secure parts of the API based on the access token your implementation should be secure enough if you use SSL/TLS for them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.