I have a phonegap app that uses jquery to post to a remote server, running on Google App Engine.
What’s the best way to ensure that only my phonegap app can post to this remote server? I’ve been scouring the web for an answer but can’t find anything concrete.
Normally I believe you’d check the referrer to ensure that the request is coming from a whitelisted domain but in this scenario there is no domain because it’s a phonegap app.
This question is similar but it’s gone unanswered:
Security issues with phonegap remote server access
You can’t. Any request that your app can make – including whatever authentication credentials you care to embed in the app – can be generated by a third-party. The most you can do is obfuscate, by embedding secrets in your app, but a clever user can extract these.
A better option would be to authenticate the user, rather than the application.