secure a REST API for use by Android clients

Question

We're developing a JSON REST API in Rails to be consumed by an Android application, which we are also developing. Is there any way to secure the API such that it can only be used by our specific Android application?

The API is read-only, and does not involve any kind of user-related or otherwise sensitive information. But to the extent that is reasonable we'd like to prevent abuse and restrict its use to only our app.

I could easily add an authentication token to the API and distribute it with the app, but:

1. We'd probably have to move the API over to SSL, if we use BASIC auth.
2. It's probably trivial for a determined person to open up the Android APK binary and uncover the auth token anyway.

The situation seems analogous to a café posting their WiFi password on the shop counter- you have to give the secret out to everyone who wants to use your service, so it almost seems pointless to have it in the first place.

What's the most reasonable approach to take?

Answer 1

Wanting to secure a probably public undocumented API so it can only be accessed by one application, means you want to stop people from using your API who are determinate of using your API.

Meaning people who would try everything possible to use your API.

If this is not the case adding a Auth token won't be trivial but at least a big stepping stone for people who stumble upon your API. And not a very bad idea to implement this.

Because this authentication isn't user based but application based and you don't want authentication to rely on user input. The request must be purely done so by the application.

Meaning you will have to do so anyway(adding hardcoded token). Only you make it very very difficult for a determined person to uncover the access and request tokens and the methods.

It depends on the situation, but I would go for the SSL and hardcoded token.

Some extra security:

• Release an access token to the application which only need to send a request token periodically. Meaning less chance people intercept the hardcoded request token, but a session based access token which expires. Maybe just do this once for every application install.
• Encode this request token before sending it through the air. Meaning people have to decompile your app.
• Obfuscate code (make it more difficult to decompile).