Cordova混合APK的Ajax请求防护及PHP接口鉴权方案咨询

Hey there, let's break down practical, actionable ways to secure your Cordova app's Ajax calls against abuse—since hybrid APKs are easy to decompile, you’re right to prioritize this. Here are the most effective approaches:

1. Token-Based Authentication (JWT or Custom Tokens) #

This is the foundational layer of security for most apps:

• Implement a login flow where your server issues a short-lived token (like JWT) after validating user credentials.
• Store the token securely on the device using cordova-plugin-secure-storage (instead of localStorage, which is easily accessible in decompiled APKs).
• Attach the token to every Ajax request in a header (e.g., Authorization: Bearer <token>).
• On your PHP backend, validate the token’s signature, expiration, and associated user permissions before processing the request.
• Pro tip: Add a token refresh mechanism so users don’t have to log in constantly, and always use HTTPS to prevent token interception.

2. Request Signing (HMAC-Based) #

This adds an extra layer to prevent tampering and replay attacks:

• Instead of just a static token, generate a unique signature for every request:
  1. Client-side: Combine request parameters, a timestamp, and a secret key (never hardcode this—fetch it dynamically after login or device registration) into a string.
  2. Hash the string using HMAC-SHA256 (or a similar strong algorithm) to create a signature.
  3. Send the signature, timestamp, and parameters in the request (either headers or a dedicated field).
• Server-side: Recompute the signature using the same secret key, parameters, and timestamp. Reject requests where the signatures don’t match or the timestamp is older than 5-10 minutes (to block replay attacks).
• Example PHP snippet for validation:

  $receivedSignature = $_SERVER['HTTP_X_REQUEST_SIGNATURE'];
  $timestamp = $_SERVER['HTTP_X_TIMESTAMP'];
  $secret = get_user_secret($_POST['user_id']); // Fetch user-specific secret from DB
  
  // Recompute signature
  $payload = http_build_query($_POST) . $timestamp;
  $expectedSignature = hash_hmac('sha256', $payload, $secret);
  
  if ($receivedSignature !== $expectedSignature || time() - $timestamp > 600) {
      http_response_code(403);
      exit('Invalid request');
  }
  

3. Obfuscate Client-Side Code #

Make decompiled JS harder to reverse-engineer:

• Use tools like Terser or Obfuscator.io to minify and obfuscate your JavaScript code. This renames variables, adds dummy code, and makes Ajax logic much harder to trace.
• Enable Cordova’s whitelist plugin (cordova-plugin-whitelist) to restrict your app to only communicate with your backend domain. This prevents attackers from modifying decompiled code to send requests to malicious servers.

4. Native Plugin Wrappers for Requests #

Move sensitive request logic to native code, which is harder to decompile:

• Create a Cordova plugin that wraps your API calls in Android’s native HTTP client (OkHttp) or iOS’s URLSession.
• Handle token storage, request signing, and header management in native code—use Android’s Keystore system to store secrets securely (it’s far more secure than JS storage).
• Expose simple methods to your JS code (e.g., NativeApi.call('/api/data', params)), so your frontend never touches sensitive keys or signing logic directly.

5. Backend-Level Safeguards (Last Line of Defense) #

Even if client-side protections fail, your PHP backend should block abuse:

• Implement rate limiting: Use libraries like php-rate-limiter to restrict how many requests a single user/IP can make in a window (e.g., 10 requests per minute).
• Validate all input rigorously: Sanitize and validate every parameter to prevent SQL injection, XSS, and other injection attacks.
• Use IP reputation checks (optional): Block requests from known malicious IP ranges or proxies.

Critical Don’ts #

• Never hardcode secrets (API keys, signing keys) in your JS or APK resources—decompilers can easily extract them.
• Don’t skip HTTPS: Without it, all requests (including tokens and signatures) can be intercepted and modified.

内容的提问来源于stack exchange，提问作者Pablo