I want to block the view of the images and video in web and mobile app. For the web, I have managed access with WAF and added the API server as a trusted domain. But in the Mobile App, the header referral is empty and unable to match the WAF trusted domain policy. Anyone can suggest what is better to way to protect the Mobile content since the WAF not working for mobile requests.
7
-
Do you control the site or are you wanting to control the clients under your control?– schroeder ♦Aug 30, 2019 at 10:45
-
Is it an app you want to filter or web requests?– schroeder ♦Aug 30, 2019 at 10:48
-
I want to control the site assets usage. This should be presentable only through the proper authenticated channel.– AadiAug 30, 2019 at 11:30
-
2Whether you realize it or not, you're effectively trying to implement a DRM, which is not at all fool proof. The best you can do is make it harder for people to access your things.– Conor ManconeAug 30, 2019 at 12:16
-
1In particularly, you should know that you haven't restricted access from the web. If all you are doing is using a WAF that requires a Referrer header, that is extremely easy for an attacker to spoof.– Conor ManconeAug 30, 2019 at 12:17
|
Show 2 more comments
1 Answer
What you want to do is called the DRM Problem, and it can't be solved. No matter what measures you take, I can always circumvent them.
- If you create an image and want to display it on my screen, I can copy it.
- If you create an audio track and want it to play on my speakers, I can copy it.
- If you create a piece of JavaScript code and want it to run in my browser, I can copy it.
As soon as I have access to it, I can copy it.