I have a .NET Web Api servicing a Cordova based mobile app and web front end written in AngularJS. I have done a ton of research and most sources don't give a great answer or one that's huge overkill for my situation. Security is not a huge concern but I want to employ some amount of basic security to ensure that only my app is making calls to my server.

All users are required to login through Facebook and do not have their own passwords for my app. My thought was, as long as they are auth'd through Facebook and the request is originating from my app, then they are good to go.

The question is, how do I ensure the request is coming from my app? During logon, I issue bearer tokens so that part is fine but what about calls that don't require authorization? The primary issue that comes to mind is submit feedback and survey forms, would hate someone jacking with those records. The best option I've come across seems to be create an encrypted token of the call parameters plus an app_secret, and attach to the request. Issues with that are couldn't someone recreate that? And since the front end is in Javascript they could find the app_secret.

1) How can I secure server to ensure pre-login calls are originating from my app?


In general, you can't. If you want to execute code on a user's machine, nothing whatsoever stops that user from manually doing the very same stuff themselves. You cannot effectively keep something secret from a motivated user and simultaneously run it on their computer; any secret in the app's code is accessible to the user. The solution is that you can't trust user-supplied input; if it's critical people not be able to submit feedback forms under fake names, for instance, you should have a user-specific secret that isn't built into the app (so that a user doesn't know other users' secrets, e.g. a user token) and use that to ensure people are who they say they are.

  • Thanks, that's what I kept finding around here but I was really hoping for a better answer. I'll accept this but please, if anyone else has another suggestion I'm all ears! Feb 4 '15 at 19:39
  • All possible answers are resumed on @cpast answer: if a user have control of your program and the device it runs on, he can do anything the program allows it to.
    – ThoriumBR
    Feb 4 '15 at 19:53

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .