title: Check if http request comes from my android app
body: <p>I retrieve data from an external server for use with my android application. I would like this data to be only accessible with my app. I use a standard http connection to get the data from apache/php server in json format. I also send some params to the server to retrieve relevant data. Now, what I'm planning to do is:</p>
  
  <ol>
  <li>Send the params</li>
  <li>Send something like md5("someSecretPhrase"+params).</li>
  <li>Check if the secret phrase is correct on the server side.</li>
  </ol>
  
  <p>Now, the question is - is it a safe approach regarding the reverse engineering? For now I can think of no other possibility to get this data. But if someone is able to decompile my apk, he will be also able to retrieve this "someSecretPhrase" (rather hard to do on the server side) and then access the server, isn't he? Is it a real threat? Is there any other possibility to authenticate my app by the server?</p>
  
  <p>I looked at the forums eg. <a href="https://stackoverflow.com/questions/6223678/identify-whether-http-requests-from-android-app-or-not-and-then-respond-appropr">Identify whether HTTP requests from Android App or not? and then respond appropriately</a>, but they don't explain the decompilation problem.</p>