If some server backend for the app is sending the requests
As I understand it, the requests that fetch data from your website are comming from a server that works as a backend for the offending Android app. You have a number of possibilities:
- Block the IP of the server. This may end up being a cat and mouse game if they change the IP, so not the greatest of solutions.
- Rate limit on IP. The server will be making loads of requests per hour, so you could probably set a limit what would not affect ordinary users. I would say that this is the most promising solution.
- Limit how many active sessions there can be for the same IP. Note that there are legitimite cases where you have more than one session on the same IP, such as multiple users logged in from the same corporate network.
- You could check that the User-Agent looks like a browser. Easy to circumvent, but much like a fence does not keep a thief out it still clearly demonstrate where the property line is.
- If your website is more of an API, you could use some other custom HTTP header that valid requests must use. Same limitations as the above point, though.
Access-Control-Allow-Origin and similar is of no use here, since they regulate what requests browsers are allowed to make. It's not relevant when a server is making the request.
If a browser, or something following SOP, is sending the request
The same origin policy prevents sites on one origin to read the responses from requests to another origin, unless the server the request is directed at has been explicitly configured to allow this (via CORS).
Your website is one origin, whatever the browser in the app is displaying is another origin. So this should be blocked by default.
If the app is sending the requests
If this is the case, you are in trouble. You could try the last two bullet points from above (User-Agent or custom HTTP header), but they can be easily circumvented. So you might be out of luck here.
