2
\$\begingroup\$

I have a tenant ID and client secret that I use to access my server and return an API key for users. I put it in start()

However, hackers can decompile my game and access the server data. Is there any way to secure my tenant ID and client secret in my client code?

\$\endgroup\$
0

1 Answer 1

4
\$\begingroup\$

What is in clients hand is by definition not secret anymore. Regardless what you do, if they are dedicated enough they can get the information that is located inside the client.

Instead why not let the client authenticate itself against the server and let the client just ask for the data? The server would not hand out the api key to the user but the result of the request that the client would make. This has some further benefits:

  • You can cache the results in case multiple clients make often the same requests
  • You know and can control which client is calling how often the endpoint
  • If data manipulation is needed (the return data from the endpoint), you can do this on the backend out of clients sight. In case of huge data this can save the client computation power. It could be a legal requirement. Or you can enrich the data. Or restructure to fit better your client.
  • People just can't take apart your client to recreate your app since the business logic (handling of endpoints, secrets) is not located in the client.
\$\endgroup\$
1
  • 2
    \$\begingroup\$ +1, I've done it this way. It's a big win for rate-limiting, so you can ensure a buggy or hacked client can't degrade server performance for everyone or run up your bills for accessing a third-party service, since you have ultimate control over how often that service actually gets accessed. Your intermediary can also provide graceful fallbacks in the event that the service is unavailable/over-budget, instead of dealing with raw errors in the client. And of course you can monitor this traffic and use it to spot hackers/cheating attempts. \$\endgroup\$
    – DMGregory
    Commented May 26, 2023 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .