I have created an Android app which sends data to a web service. Right now the user sends his test results (test id, test name, test time, and user ID). The problem is that I send the data from the client to the web service in JSON; the web service can be accessed in the browser. However, an unauthorized user could use his browser to call the webservice method for inserting the score. How can I solve this problem? I need to let only the Android client send the data to the webservice.


In general, this can't be done. If the user has access to the app, they can reverse-engineer it and undetectably emulate everything it does.

What you can do is put obstacles in their path. Simply transmitting a salted hash alongside the data will stop 99% of would-be attackers; if you're willing to go to greater effort, using public-key cryptography to encrypt and sign the message being transmitted will stop almost everyone.

This won't stop or even significantly slow a professional attacker, but if your primary threat model is "college student majoring in art history" or "casual Facebook user", it's more than adequate.

  • As this is the correct answer let me put here how to do it correctly - approach the application like it is a web browser. It doesnt need direct writing access to the database like a super user, instead establish an authentification system where some people can modify things and the public cannot. Dec 18 '15 at 14:30

Call the sendPostRequest(String username, String pass) method with parameters. You can call this method from the UI thread, the request will be sent from a different thread (AsyncTask is embedded).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy