19

I am developing RESTful APIs with ASP.NET WebAPI for an Android application and there is an option to make a registration through our application. Suppose that our registration endpoint is something like '/api/register/' with some parameters like 'username', 'password' and 'email address'. So this endpoint is likely to be opened not only for Android device, but for everyone.

I mean it is easy to trace all the requests and responses to and from our server, so a bad person may calls this endpoint to start registering many users in our system.

I want to know how I can secure my API?

7
  • Do you need to have the registration API on REST? considered using GCM client to server communication?
    – CristianTM
    Jan 13, 2016 at 23:04
  • I only know that GCM is a Google service to help developers for implementing notifications. Can it be used for such use cases?
    – jmosawy
    Jan 14, 2016 at 8:47
  • 1
    It also allows client to server messages. You could use that and therefore be sure that the messages come from your APP.
    – CristianTM
    Jan 14, 2016 at 9:07
  • @jmosawy Have you got the answer of your question? Many people got the same problem as yours and still remain unanswered. Please share if you have solved your problem. I have been waiting for 3 months hoping any 'smart' people post a real answer. Dec 24, 2016 at 12:13
  • @SulungNugroho Since I have done a lot of researches, I couldn't find a solution that makes me sure the request is actually coming from our own clients. Throttling, SSL and JWT were the only solutions I could use for the project. I'd be happy if you share any solutions or tricks you found during this period of time you were researching.
    – jmosawy
    Dec 24, 2016 at 12:48

1 Answer 1

18

You can take a number of steps to ensure your API can't be called by a random client. These will be effective for 99.9% of the potential threats, but keep in mind that if someone is very committed and is able to decompile your Android app and man-in-the-middle your app's connection, they can still break your security. (I wouldn't worry about such special cases unless you are trying to protect a really high value target.)

For a basic level of protection:

  • Only allow SSL connections, and require "Strict-Transport-Security"
  • Use a shared secret that will be validated on the server (e.g. predefined api key, pre-installed client cert, etc.)
  • Throttle API calls on the server
  • Ensure that your API does not suffer from other common security pitfalls (use the OWASP Checklist: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet)

For increased security, you will need to implement some kind of pre-authentication, similar to the flow I describe here:

  • The client asks for an access token from the server.
  • The token is unique to the client and generated using the client IP, request time, and the shared secret. It's also short-lived and set to expire soon.
  • The client makes the API call using the unique token while it's still alive.
  • The server validates the token, confirms it's coming from the authorized client and processes the API call.

This topic is more complex and unfortunately I haven't come across a simple example that I can point you to.

1
  • 1
    Can you explain further how to generate a pre-authenticated token? How to secure the pre authenticated token API? The attacker can also call the pre authenticated token api
    – Dibish
    Nov 17, 2022 at 4:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.