0

I have coded a C# MVC5 Internet application and I have a Web API 2 web service that returns JSON data. I am retrieving this JSON data in an android application.

How can I add a feature to the web service such that only my android application can retrieve the JSON data? I am wanting to do this so that other web users cannot hammer the url and the web service will not send my data to unwanted applications and/or users.

Is this possible? If so, how should I do this?

Thanks in advance.

Simon
  • 7,991
  • 21
  • 83
  • 163
  • Add some security like authentication? A random google gives me http://www.asp.net/web-api/overview/security – Maarten Aug 18 '14 at 07:31

3 Answers3

0

You have various ways to achieve this in fact.

For example, you can store a key in your android application and use send this key together with the request to your WebAPI. Your webAPI will than check if they key is valid and if it is, it will return the JSon.

However, there's no way to ensure that nobody else can request and get your data. For example by reverse engineering your android application and extracting the key, or by monitoring the network traffic and find the key in there.

You need to understand that there isn't anthing that guarantuees you 100% security.

See it as the following:

You have an open door right now, you can close it little by little, but closing and locking down is not possible. There will always be gap. A house also can't by made burglar proof, but you can make it very hard for a buglar to enter.

Complexity
  • 5,682
  • 6
  • 41
  • 84
0

Go to this link Web Api. I have used the individual authentication for my web api. When you will register the user the response you will get is access token and use that access token as Authentication header in your ajax call if you are using Jquery ajax to call your Web Api. Refer this The OAuth 2.0 Authorization Framework. Hope this help you.

Community
  • 1
  • 1
Rushee
  • 766
  • 7
  • 18
-3

Are you looking for something like this? http://httpd.apache.org/docs/2.2/howto/access.html

If you have other web server, there should be appropriate means to support such.

Sriram
  • 78
  • 1
  • 2
  • 10
  • It's quite unlikely that the WebAPI service is hosted in Apache. – Tom Chantler Aug 18 '14 at 07:32
  • Almost certainly not. The question is about an Android application, so presumably runs on the end user's device and does not have a pre-known IP address. –  Aug 18 '14 at 07:32