Twitter API Question posted in
The official Twitter API documentation can be found here.

Protect RESTful calls to register users from mobile – Twitter-api

Users sign up in my platform from the mobile app (Android & iOS). Once they have completed a form, I do a RESTful call to my server with the username and password and an API key.

https://api.example.com/v1/users/register

I assume that the API key is not protected since it is embedded in the app, so anyone can actually make that RESTful call and register as many users as they want.

How can I protect this call so that users can sign up ONLY from the mobile app? How do other apps (e.g. Facebook, Twitter,…) solve this problem?

Tags:

2

Answers


  1. 0

    I think you have to devise a flow like reCAPTCHA. Its documentation may give you a hint.

    Login or Signup to reply.
  2. 0

    How can I protect this call so that users can sign up ONLY from the
    mobile app? How do other apps (e.g. Facebook, Twitter,…) solve this
    problem?

    There is no way to restrict your RESTful call just for mobile phones. Anybody could emulate that call impersonating a device manipulating headers or whatever. The only way to face this problem is to have a good security protocol design between your app and your backend.

    As you mentioned, Facebook and other big companies do not store any API Key since the beginning in their app, instead they allow users to sign up through a website or mobile setting up specific user credentials. These signing ups are protected agains massive registration attacks using anti-bot techniques both from client (CAPTCHA) and server side (source IP + timings). Once those credentials are created and authenticated, their endpoint will return a client specific token which would be valid to make further REST API calls, and only this very user will be authorized to use that token for a limited period of time. One typical approach nowadays is to use Oauth 2.0 as you can see in many public API specifications like: Paypal, Twitter, Facebook, etc. I suggest to research other famous REST API specifications, you can learn a lot from them.

    Almost all of known techniques mentioned before like CAPTCHA, server side checks and so on could be defeated by a hacker. However, if you still want to add some additional barriers to avoid unlimited user accounts, one good idea can be to add two-step verification process to verify an account. Unless this process is finished correctly, the user won’t be able to use your backend API (apart from the one to authorize the account). Thus, a user may be able to create a few accounts with different phone numbers, but never an unlimited amount of them.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search