0

I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header referral is empty and unable to match the WAF trusted domain policy. Anyone can suggest what is better to way to protect the Mobile content since the WAF not working for mobile requests.

  • Do you control the site or are you wanting to control the clients under your control? – schroeder Aug 30 '19 at 10:45
  • Is it an app you want to filter or web requests? – schroeder Aug 30 '19 at 10:48
  • I want to control the site assets usage. This should be presentable only through the proper authenticated channel. – Aadi Aug 30 '19 at 11:30
  • 2
    Whether you realize it or not, you're effectively trying to implement a DRM, which is not at all fool proof. The best you can do is make it harder for people to access your things. – Conor Mancone Aug 30 '19 at 12:16
  • 1
    In particularly, you should know that you haven't restricted access from the web. If all you are doing is using a WAF that requires a Referrer header, that is extremely easy for an attacker to spoof. – Conor Mancone Aug 30 '19 at 12:17
2

What you want to do is called the DRM Problem, and it can't be solved. No matter what measures you take, I can always circumvent them.

  • If you create an image and want to display it on my screen, I can copy it.
  • If you create an audio track and want it to play on my speakers, I can copy it.
  • If you create a piece of JavaScript code and want it to run in my browser, I can copy it.

As soon as I have access to it, I can copy it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.