I have an Android app that calls a SOAP WS. The WS call goes over HTTPS and has credentials (user and pass)

(this is not a specific user/pass, but the user/pass of the WS itself)

How should I store the user/pass ?

I know if I put the hardcoded password, any attacker may be able to decompile the app and get it.

  • 1
    Assuming you are trying to protect that user/pass against the WS, you cannot - users don't even need to decompile the app - they can find out everything you do over https with a web proxy (if they own the android device, they can mitm even https, since they can add their own root cert). Your best bet is to register each user, give each its own username/password. You can then revoke access for those individual credentials in case of abuse. – crovers Sep 15 '16 at 14:02

This sounds like a re-architecture may be required. As Crovers mentioned above, you will not be able to protect the username and password if they are stored locally on the device. You will need some form of proxy in between the web service endpoint and the device.

Best Practice

Best practice would be to give each user his or her own credential for the proxy, and then the proxy itself would connect the the SOAP endpoint. The Proxy would connect to the SOAP Service via SSL

A not recommended work-around

Depending on your security requirements, you may be able to get away with less stringent requirements. If there are particular operations on the SOAP service that you do not want your users to be able to access, you can simply not expose them via the proxy application. For example, if the SOAP service exposes an add, an edit, and a delete operation, and you don't want your end users to use the delete operation, your proxy application would not expose a delete operation to your users. Please note that this solution will only work with vertical access control, and not horizontal access control. It will only prevent users from performing unauthorized actions, such as the delete example. It will not prevent users from performing authorized actions against object which they should not be able to access (i.e. If I can update my records, I can also update your records.)

I hope that helps. Please go with the best practice if at all possible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.