<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /></head><body>Then unsubscribe from this mailing list.<br><br><div class="gmail_quote">On 30 May 2016 13:41:35 CEST, saikat_sarkar <saikat_sarkar@hotmail.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div>Stop this spam</div>
<div><br />
</div>
<div><br />
</div>
<div style="font-size:9px">Saikat</div>
<div style="font-size:9px">Sent from Samsung Mobile</div>
<br />
<br />
-------- Original message --------<br />
From: aiman parvaiz <aimanparvaiz gmail.com="gmail.com"><br />
Date:30/05/2016 1:16 PM (GMT+05:30) <br />
To: Unai Rodriguez <unai sysbible.org="sysbible.org"><br />
Cc: flask@python.org <br />
Subject: Re: [Flask] Flask secret key for mobile app client <br />
<br />
<div>
<div dir="ltr">
<div>
<div>The case under consideration is that right now any one can jump on a tool as simple as Postman(on Chrome browser), construct the API call and get data from the backend. I need a way to allow only mobile devices with the installed app to see the returned
data and how can I ensure that a API call from any client other than mobile devices don't get a response from my server.<br />
<br />
</div>
I would appreciate any help I can get here.<br />
<br />
</div>
Thanks<br />
</div>
<div class="x_gmail_extra"><br />
<div class="x_gmail_quote">On Mon, May 30, 2016 at 12:07 AM, Aiman Parvaiz <span dir="ltr">
<<a href="mailto:aimanparvaiz@gmail.com" target="_blank">aimanparvaiz@gmail.com</a>></span> wrote:<br />
<blockquote class="x_gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="auto">
<div>Thanks for the response Unai. This app would be open to the general public indeed. Can you please throw more light on SSL+ authentication?</div>
<div>I would be using SSL for this but what do you mean by authentication from mobile phone?</div>
<div><br />
<br />
Sent from my iPhone</div>
<div>
<div class="x_h5">
<div><br />
On May 29, 2016, at 9:09 PM, Unai Rodriguez <<a href="mailto:unai@sysbible.org" target="_blank">unai@sysbible.org</a>> wrote:<br />
<br />
</div>
<blockquote type="cite">
<div>
<div>If the people using the app can be anyone (I.e. it's open to general public) you cannot. Typically SSL I.e. HTTPS) plus authentication is used for this.<br />
</div>
<div> </div>
<div>If the people that are supposed to access have something in common (I.e. they come from a specific office, etc) then you might be able to add rules on a firewalll. But that can be a problem (rules not correct or people accessing through a VPN etc). I guess
the only way is if the app is served only to the people that are supposed to access the through some sort of a corporate /private network .<br />
</div>
<div> </div>
<div> </div>
<div> </div>
<div>
<div>-- unai<br />
</div>
</div>
<div> </div>
<div> </div>
<div>On Mon, May 30, 2016, at 09:56 AM, aiman parvaiz wrote:<br />
</div>
<blockquote type="cite">
<div dir="ltr">
<div>
<div>
<div>Hi all<br />
</div>
<div>I am new to flask and am writing a REST API backend for a mobile app. My question is how can I ensure that call to my endpoints is only being done by my mobile app and not by some one who has guessed the endpoint.
<br />
</div>
</div>
<div>What would be the best way to avoid this kind of behavior.<br />
</div>
</div>
<div>Thanks<br />
</div>
</div>
<div><u>_______________________________________________</u><br />
</div>
<div>Flask mailing list<br />
</div>
<div><a href="mailto:Flask@python.org" target="_blank">Flask@python.org</a><br />
</div>
<div><a href="https://mail.python.org/mailman/listinfo/flask" target="_blank">https://mail.python.org/mailman/listinfo/flask</a><br />
</div>
</blockquote>
<div> </div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br />
<span>Flask mailing list</span><br />
<span><a href="mailto:Flask@python.org" target="_blank">Flask@python.org</a></span><br />
<span><a href="https://mail.python.org/mailman/listinfo/flask" target="_blank">https://mail.python.org/mailman/listinfo/flask</a></span><br />
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<br />
</div>
</div>
<p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre class="k9mail"><hr /><br />Flask mailing list<br />Flask@python.org<br /><a href="https://mail.python.org/mailman/listinfo/flask">https://mail.python.org/mailman/listinfo/flask</a><br /></pre><p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre class="k9mail"><hr /><br />Flask mailing list<br />Flask@python.org<br /><a href="https://mail.python.org/mailman/listinfo/flask">https://mail.python.org/mailman/listinfo/flask</a><br /></pre></unai></aimanparvaiz></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>