Java servlet: only allow own client

Question

Im developing a little serverside api to use with a java client (which i wrote too).

The api is written with jersey (RESTful) und running on a tomcat server. The data it provides is passed to the client as Json-String and all communication is performed via Http.

I now want to ensure that only my own client programm is able to access the api (At the moment, as its http, everyone could receive the json data via an ordinary browser). Therefor, im looking for a way to "identify" my clientside programm to the api with a key or something like that. I first thought about using the user-agent for identification, but this could easily be copied. So i need some kind of key which changes dynamically or something like that.

Whats a good way to do that?

I searched in the net but didnt find a proper answer (maybe wrong keywords?), so im happy for every hint and/or link about that topic.

Edit: The client side programm is an android app. I want to make sure noone is creating a similar app and use my server for his purpose.

You can't do it. Anyone could make their browser look exactly like your client, as it is code running on their own computer. — Matt Bryant
– Matt Bryant, Commented Aug 4, 2013 at 19:16
The typical verbiage is "api key" as used by Facebook and other sites with app capabilities. These keys are usually of significant length. However, everything sent over http will be visible to "the internet" and thus will have no practical security value. — abiessu
– abiessu, Commented Aug 4, 2013 at 19:18
@abiessu api keys sounds interessting. The only problem is, as you mentioned, everyone could read one of the keays out of the http package and simply reuse it. — danijoo
– danijoo, Commented Aug 4, 2013 at 19:45

Jonathan S. Fisher · Accepted Answer · 2013-08-04 19:27:41Z

4

If the attacker has a the client in his possession, there's almost no security that can't eventually be compromised.

A good start, that's fairly out of box is bi-directional SSL authentication (Client and Server certificates). This is supported out of the box and requires little code changes.

answered Aug 4, 2013 at 19:27

Jonathan S. Fisher

9,1667 gold badges54 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Java servlet: only allow own client

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related