blocks|key|902239|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|-4|4|5|6|B|7|@]|8|@]|9|$]]]|A|$]]

My congratulations. You seem to be a very informed developer in terms of security and that is always good to see :)
<h2>The Difference Between WHO and WHAT is Accessing the API Server</h2>
<blockquote>
Now I would like to get a understanding how to mitigate the risk, that someone like me can have access to these used API keys.
</blockquote>
First I would like to clarify a usual misconception that arises often among developers of any seniority level, that is about knowing the difference between who vs what is in an API request.
I wrote a series of articles around API and Mobile security, and in the article <a href="https://blog.approov.io/why-does-your-mobile-app-need-an-api-key#api-who-vs-what" rel="nofollow noreferrer">Why Does Your Mobile App Need An Api Key?</a> you can read in detail the difference between who and what is accessing your API server, but I will extract here the main takes from it:
<blockquote>
The what is the thing making the request to the API server. Is it really a genuine instance of your mobile app, or is it a bot, an automated script or an attacker manually poking around your API server with a tool like Postman?
</blockquote>
<blockquote>
The who is the user of the mobile app that we can authenticate, authorize and identify in several ways, like using OpenID Connect or OAUTH2 flows.
</blockquote>
So, think about the who as the user your API server will be able to Authenticate and Authorize access to the data, and think about the what as the software making that request in behalf of the user.
Now, I hope we are in a better mindset to find some possible solutions to your questions.
<h2>Locking Down the API Backend to the Mobile App</h2>
<blockquote>
How to properly store and transmit API keys within mobile applications?
What is the best practice to communicate via a mobile app with a remote API, that requires an API key?
</blockquote>
So, usually mobile apps use the API key to identify themselves to the API backend, but this not enough for the API backend to have a very high degree of confidence that the request is coming from what it expects, a genuine and unmodified instance of the mobile app.
Depending on your budget and resources you may employ an array of different approaches and techniques to defend your API server, and I will start to enumerate some of the most usual ones.
You can start with <a href="https://www.google.com/recaptcha/intro/v3.html" rel="nofollow noreferrer">reCaptcha V3</a>, followed by <a href="https://en.wikipedia.org/wiki/Web_application_firewall" rel="nofollow noreferrer">Web Application Firewall</a>(WAF) and finally if you can afford it a <a href="https://en.wikipedia.org/wiki/User_behavior_analytics" rel="nofollow noreferrer">User Behavior Analytics</a>(UBA) solution.
Google <a href="https://www.google.com/recaptcha/intro/v3.html" rel="nofollow noreferrer">reCAPTCHA V3</a>:
<blockquote>
reCAPTCHA is a free service that protects your website from spam and abuse. reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep automated software from engaging in abusive activities on your site. It does this while letting your valid users pass through with ease.
</blockquote>
<blockquote>
...helps you detect abusive traffic on your website without any user friction. It returns a score based on the interactions with your website and provides you more flexibility to take appropriate actions.
</blockquote>
<a href="https://en.wikipedia.org/wiki/Web_application_firewall" rel="nofollow noreferrer">WAF - Web Application Firewall</a>:
<blockquote>
A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security misconfigurations.
</blockquote>
<a href="https://en.wikipedia.org/wiki/User_behavior_analytics" rel="nofollow noreferrer">UBA - User Behavior Analytics</a>:
<blockquote>
User behavior analytics (UBA) as defined by Gartner is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns—anomalies that indicate potential threats. Instead of tracking devices or security events, UBA tracks a system's users. Big data platforms like Apache Hadoop are increasing UBA functionality by allowing them to analyze petabytes worth of data to detect insider threats and advanced persistent threats.
</blockquote>
All this solutions work based on a negative identification model, by other words they try their best to differentiate the bad from the good by identifying what is bad, not what is good, thus they are prone to false positives, despite of the advanced technology used by some of them, like machine learning and artificial intelligence.
So, you may find yourself more often than not in having to relax how you block the access to the API server in order to not affect the good users. This also means that this solutions require constant monitoring to validate that the false positives are not blocking your legit users and that at same time they are properly keeping at bay the attackers.
<h3>A Possible better solution</h3>
Regarding APIs serving mobile apps a positive identification model can be used by implementing a Mobile App Attestation solution that attests the integrity of your mobile app and device its running on before any request is made to the API server.
I recommend you to read <a href="https://stackoverflow.com/a/60605789/6454622">this StackOverflow answer</a> I gave to the question How to secure an API REST for mobile app?, especially the sections Hardening and Shielding the Mobile App, Securing the API Server and A Possible Better Solution.
In a nutshell, the Mobile App Attestation solution will allow the API backend to identify with a very high degree of confidence that what is making the API request is indeed a genuine and unmodified instance of the mobile app.
<h2>Do You Want To Go The Extra Mile?</h2>
In any response to a security question I always like to reference the excellent work from the OWASP foundation.
<h3>For APIS</h3>
<a href="https://github.com/OWASP/API-Security" rel="nofollow noreferrer">OWASP API Security Top 10</a>
<blockquote>
The OWASP API Security Project seeks to provide value to software developers and security assessors by underscoring the potential risks in insecure APIs, and illustrating how these risks may be mitigated. In order to facilitate this goal, the OWASP API Security Project will create and maintain a Top 10 API Security Risks document, as well as a documentation portal for best practices when creating or assessing APIs.
</blockquote>
<h3>For Mobile Apps</h3>
<a href="https://www.owasp.org/index.php/OWASP_Mobile_Security_Project#Top_Ten_Mobile_Risks" rel="nofollow noreferrer">OWASP Mobile Security Project - Top 10 risks</a>
<blockquote>
The OWASP Mobile Security Project is a centralized resource intended to give developers and security teams the resources they need to build and maintain secure mobile applications. Through the project, our goal is to classify mobile security risks and provide developmental controls to reduce their impact or likelihood of exploitation.
</blockquote>
<a href="https://github.com/OWASP/owasp-mstg" rel="nofollow noreferrer">OWASP - Mobile Security Testing Guide</a>:
<blockquote>
The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security development, testing and reverse engineering.
</blockquote>

As I am currently working a lot with mobile applications a question arised:
How to properly store and transmit API keys within mobile applications?
When I analyze mobile applications most of the times it is easy with the right tool to extract secret information (e.g. dump the keychain, reverse engineer crypto functions, detect hardcoded secrets with static analysis, ...) from the app. Therefore often is is possible to get a used API key at rest.
The other way is to monitor the traffic and perform a MITM attack.
Therefore the API keys can often be sniffed at transit. Even if certificate pinning is used, there are easy ways to circumvent client side mechanisms like that.
Now I would like to get a understanding how to mitigate the risk, that someone like me can have access to these used API keys. What is the best practice to communicate via a mobile app with a remote API, that requires an API key?

Manage API key on mobile platform

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

由于我目前正在大量使用移动应用程序，因此提出了一个问题：在移动应用程序中正确存储和传输API密钥的How？当我大多数时候分析移动应用程序时，使用正确的工具提取秘密信息是很容易的(例如，转储密钥链，反向工程密码功能，用静态分析检测硬编码秘密，.)从应用程序。因此，通常可以获得一个已使用的API键at rest。另一种方法是监视流量并执行MITM攻击。因此，API键通常可以被嗅探到at传输。即使使用了

在移动平台上管理API密钥-腾讯云开发者社区-腾讯云

问在移动平台上管理API密钥
EN

回答 1

Security用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在移动平台上管理API密钥EN