How do I restrict Google App Engine Endpoints API access to only my Android applications?

Question

I am an Android developer building my first Google App Engine (java) back-end for my apps. I don't want anybody else to access this API other than my app. (I plan to use App engine for verifying InApp purchases in my Android app). My data is not relevant to users so, I don't want users to be able to access my API even if they are logged in with their Google accounts (on web or Android devices).

I followed the steps mentioned in - "Specifying authorized clients in the API backend" (https://developers.google.com/appengine/docs/java/endpoints/auth) like generating client IDs and add them in @Api (clientIds and audiences) except "Add a User parameter" - since I don't need user authentication.

Then I deployed App engine and I am still able to access the API through API explorer (https://your_app_id.appspot.com/_ah/api/explorer) (I haven't added API_EXPLORER client ID)

I tested with the APK that was built with the endpoint libs before adding client IDs and can still access the API.

• Is adding a "User parameter" to all endpoint APIs a must? to achieve my purpose (restrict API to only my Android apps).

• Can I pass null as userAccount name from Android client and ignore user parameter value on server (since it will be null)? Will this ensure that the API is accessible only from my android apps (since the client ID is generated for my package name and SHA1 of the APK?)

• Should I use something like a service account for this purpose?

The documentation says for Android, both Android and Web client IDs must be added and audience must be the same as web client ID. Does this open access to any other web client? can I skip mentioning web client ID and still achieve my purpose?

Appreciate your time and help.

...... updating with my further investigation ...

I did the following:

• Added User parameter to APIs on backend - but did not check for null value. API can still be accessed without passing any credentials (from Android debug APK and API explorer)

• Then, I tried

  mCredential = GoogleAccountCredential.usingAudience(this, "server:client_id:" + WEB_CLIENT_ID); mCredential.setSelectedAccountName(null);

and passed this credential to API builder (as suggested in some other posts) Caused FATAL EXCEPTION. So, we can't pass null account name.

• I could call the API using API explorer without OAuth. But when I enabled OAuth, it gave error saying this client ID is not allowed! ( I haven't yet added com.google.api.server.spi.Constant.API_EXPLORER_CLIENT_ID in client_ids{})

• Then I added code to throw OAuthRequestException on the backend if the user is null. This resulted in API explorer getting errors without OAuth. It works with OAuth enabled after adding API_EXPLORER_CLIENT_ID to client_ids)

• Added code to pass valid user account name(email) from my Android app. Then, I am able to access API only with my release APK. Even the debug APK gets exceptions! - which is what I expected..So, I assume no other Android apps will be able to access this API.

So, not checking for null user on back-end API is a bad idea (as suggested in other posts). It is as good as not mentioning any client_ids and not having User param.

Only question I have at this moment is: If some one can figure out the WEB_CLIENT_ID from the APK, will they be able to use it to build a web client to access my API (I haven't mentioned client secret anywhere in the code. So I am thinking this is not possible).

---

I did search Google groups and Stackoverflow, but still it is not clear.

• (Authenticate my “app” to Google cloud endpoints not a “user”) Authenticate my "app" to Google Cloud Endpoints not a "user"

• (How do I protect my API that was built using Google Cloud Endpoints?) How do I protect my API that was built using Google Cloud Endpoints?

• (Restrict access to google cloud endpoints to Android app) Restrict access to google cloud endpoints to Android app

Answer 1

I had a similar issue, not between Android and App Engine, but between a separate server and App Engine. The way I handled it was to add a signature hash field as a parameter to each API call. If the request had an improper signature, it would be denied.

For example, suppose your API end-point is example.com/api/do_thing?param1=foo. I would hash the entire url, along with a secret key, and then append the result of the hash to the request: example.com/api/do_thing?param1=foo&hash=[some long hex value].

Then, on the server side, I would first remove the hash from the url request, then run the hash on everything that was remaining. Finally, you check whether the calculated hash matches the one that was sent with the request and if they don't, you can deny the request.

It is very important however that your secret key remain secret. You have to be careful with this on Android because someone could attempt to decompile your APK.