My Rest API is protected using Oauth2. My main client is a native app.

it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning that if the user obtained the access token - he will not be able to use curl in order to call my Rest api.

For example if i have a Rest api for Achievement unlocking, how can i make sure that an authenticated user will not be able to call this rest api in order to unlock the achivment?

Solutions that i thought of:

  1. Sign the request with a special header - But i think that it's breakable

As soon as you deploy your client to a device you cannot fully control, there is no way to be absolutely sure anyone can tamper with the requests.

What you can do though is put some measures in place that will require work from the attacker, for example, you could encrypt and/or sign your data using embedded keys in the application. In order to send data to the server, the attacker would have to perform the task of encryption/signature to send you valid data. This means he would have to reverse engineer the application or find a way to use your app to do the work for him (which should not happen). Someone motivated enough will eventually succeed since all the data are present on his device. The idea is to be time consuming so that he will find it not worth the effort.

OAuth only solves the problem of authorising a specific user. So you should be able to ensure that a user can only tamper with it's own requests and not the requests of others.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.