1

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer an app's .apk file to get the java code containing the REST credentials.

So I'm wondering if there are ways to secure the credentials against reverse engineering revelation?

2
  • it the same situation as client-side JS, where you have to use a server you control to talk to the API using your credentials, then echoing back the response to the app. in this way, the app doesn't have the keys, only the "proxy" server.
    – dandavis
    Commented May 30, 2016 at 3:03
  • 1
    you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. you can't control the client. Commented May 30, 2016 at 3:30

1 Answer 1

2

The best practice is to not store the access credentials within the program. Apps do not always contain (unless they are badly designed) any specific credentials within themselves to access the API.

While adding credentials into the code may deter general attackers it will not stop attackers who can open up the package and extract the details. As something that can be cracked by a few is considered vulnerable too the right way to implement it would be as follows.

  1. Add not credentials into the APP
  2. When the APP is installed generate credentials and register with the server. (could be username and password or could be a client side certificate)
  3. Obtain an access token using these credentials.
  4. Use the access token to access the API

As you can efficiently control the registration process and can permit access to secure parts of the API based on the access token your implementation should be secure enough if you use SSL/TLS for them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .