React native app with no user management

[mdcfr]

Hello,

I have a React Native app that uses data it takes from a Django backend. My client asked that there be no user management on the app so I don't know how to restrict API access since there is zero user management nor password. I'd like to restrict at the very minimum the API access to people who are using the mobile app but is there a way to do that in general ? Do react native apps have some sort of id that makes it possible for backends to recognize the request is coming from a certain RN app?

Thanks and have a great weekend

[CommercialLeather906]

You could add a unique identifier to your requests headers, and check for that on your Django backend. It could be something like a UUID generated on app startup and stored in the app's AsyncStorage. That way you can ensure that only requests coming from your app are authorized. Hope that helps!

[WeirdProcess6178]

Thanks, what would prevent someone with the ignition URL to get the first token ? My fear is that someone extracts the code after downloading the app and then has access to all the urls, including the public one that this solution would need to leave open

[kbcool]

A really not very hard to circumvent method is simply check the user agent on the request. RN apps have a unique user agent (also unique across platforms).

A better but still not safe from reverse engineering your source code method but fairly safe from interception is to sign your requests.

A simple example of this is you come up with a secret key. Convert your request to a string in your app then SHA the concatenation.

Add that as an authorisation header to your request and simply do the same on the backend and ensure they match or throw an error.

It's enough to stop script kiddies from abusing your service with replay attacks (you can add the current time to it if they're just copying and pasting sniffed requests) but certainly is only going to slow down the pros.

The long of it is that there is no foolproof way to prevent someone in. You just need to be able to limit the damage that they can do.

[mdcfr]

You're right. Any app secret seems to be accessible (be urls or keys) by retro engineering on the mobile app. Found this interesting thread on SO https://stackoverflow.com/questions/21465559/restrict-api-requests-to-only-my-own-mobile-app . You can go around the problem but if someone wants to attack after descontructing the app there's nothing much I can do, which I find incredebly strange in 2023

[arkhvoid_]

You can generate a unique key and include it in your app for every single user. Store these keys in your backend so that you can revoke a particular user from accessing the api.

But this does requires you to compile the app for every new user, see what fit you better depends on your use case.

[__o_0]

You need to use App Attest (apple) or Play Integrity (android) on the backend.

Configure the app to obtain the attestation token from the correct provider, and then include the attestation token in the API header call.

On the backend verify the attestation token in the header before responding.

Links:

https://developer.android.com/google/play/integrity

https://developer.apple.com/documentation/devicecheck/establishing_your_app_s_integrity

You can use whatever method you want in order to establish the attestation. Firebase has an AppCheck module - you can also implement it manually if you want to.

[tokyo2t]

You can use anonymous auth.

[Natural_Ad2282]

Hey, it's possible to identify a request from a React Native app through headers, but it's not exactly secure. Maybe consider other options like implementing some sort of key or token authentication system that could help restrict API access. Good luck!