Hacker News Reader

Comment by srameshc | Hacker News Reader

Obvious question: How to protect against this ?

Build your API assuming anything public facing will be known. This includes anything downloaded to a device.

Your first line of defence should be a secure API where an attacker doesn't gain anything by knowing it.

You can add obfuscation, but ultimately if the client is shipped to the user you must assume an attacker can reverse engineer it.

What specifically do you want to protect?

for me, we cant 100% protect again this type of usage but we can minimize with good observarbility and monitoring tools that always check if user is run this via verified way (signed app,web or etc) or RE'ing the api <<

because guess what??? we are the creator of such system, its easy to detect bot/such case when you have good analytical data because this type of way does not give any "traces"

I find this confusing because the point of an API is to be known, yes? Otherwise who's accessing it?

It's a valid desire, but you have to be really dedicated to the effort to block it, in practice.

You might intend your API to be consumed only by your own clients. E.g. your published mobile apps.

A well-designed API won't allow a third-party client to do anything that your own client wouldn't allow of course. Permissions are always enforced on the back end.

But there are many cases where a user might want a custom/different client:

If your mobile apps are not awesome, or if they deprioritize a specific use case, or if they serve ads ... or even if your users want to automate some action in your service...

If your service is popular enough (or you attract a certain kind of user), you will have some people building their own clients.

Those sound like bad use cases for a client-server model with public endpoints, then? I mean, you could cert-pin yourself in the client app, I guess.

Not sure what you mean here. All endpoints are equally public.

Not necessarily. A common pattern is to build a 'private API' intended to be used by one's own front-end applications. For example: most client-rendered applications, like the Airbnb example on this page.

Modern APIs are actually most of the times poor man's RPC, they don't need to exist, much less known.

Reply on news.ycombinator.com