Let's assume I have a mobile app that fetches the news feed from an url on my server.
Is there a way to restrict the access to this endpoint to only from within the mobile app, not other sources souch as a script (Python, NodeJs,... ) or software (Postman, Browser....) ?
I assume that this url should be compiled in binary and since the request is secured (https) packet sniffing software will only reveal the base url (example.com in this case) and the endpoint & body will be encrypted.
But I assume that there still ways to know this endpoint. I suspect two possibilities
- Installing a thrid party certificate on the mobile phone to decrypt the packets
- Using a decompiler
I just have a rough idea but I am not sure about the technical feasibilities of these two methods.