This question already has an answer here:

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and installed root certificates on his device and got my Web API.

So, Please give me advice how i can protect my WebAPI.

marked as duplicate by Steffen Ullrich tls Nov 27 '18 at 16:07

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • The question seems related to this question – Josef Nov 27 '18 at 11:32
  • I think question is different from this This Question. – Pramod Tapaniya Nov 28 '18 at 6:18
  • @Josef In that question ask about Access Web-Service from Un-Authorize user only. I am asking Web-Service hit from app, will not show in charles. – Pramod Tapaniya Nov 28 '18 at 6:25

You can't.

You can explicitly check the certificate used in your app.This will make it harder for anyone to use a MITM proxy. But if the app is running on the device of the attacker, they can change the code and allow their own certificate.

  • without any change in the code possible? – Pramod Tapaniya Nov 27 '18 at 11:31
  • It is not possible at all. – Josef Nov 27 '18 at 11:33
  • web request of some apps not showing in charles how that possible? – Pramod Tapaniya Nov 27 '18 at 11:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.