title: How can I make a communication exclusively trusted between mobile/web clients and back-end?
body: <p>I have a mobile and web application to stream music. Here is my actual architecture:</p>
  
  <ul>
  <li>RESTful service (Spring Boot)</li>
  <li>Spring Security</li>
  <li>OAuth2</li>
  <li>HTTPS with domain certificated by CA</li>
  </ul>
  
  <p>The questions is:
  <strong>How can I make a communication exclusively between my mobile clients and back-end?</strong> (same thing between web client and back-end)</p>
  
  <p>My suggestion is to split the problem in two parts - create <strong>two web services</strong>: </p>
  
  <ol>
  <li>One back-end for mobile apps (without CRSF protection) with user certificate.</li>
  <li>One back-end for web player (with CRSF protection) accepting requests only from web player's domain.</li>
  </ol>
  
  <hr>
  
  <p>For mobile problem, </p>
  
  <p>I'm able to intercept my mobile requests via proxy using Fiddler, decrypting HTTPS and getting important information like URL, headers, tokens.</p>
  
  <p>But I know that there is an approach to avoid it making requests rejected when intercepted by another CA, like a exclusively trusted communication between back-end and mobile apps. How can I do that for mobile solution?</p>
  
  <hr>
  
  <p>For web player problem,</p>
  
  <p>he problem is bigger because browser will show headers, urls and tokens to anyone.</p>
  
  <p>As I can't hide these information like mobile app do, I could make my back-end accept requests only from web player's domain. What is the best solution for this case?</p>
  
  <hr>
  
  <p><strong>UPDATED</strong></p>
  
  <p>Decompile mobile client is simpler than I imagined. As I can't protect/ofuscate keys, tokens and urls, my suggestion is <strong>to limit requests per user's token on back-end</strong>. But how can I do that on web player? I have the same token for anyone (no user's authentication).</p>
  
  <p>I found this documment about decompile mobile clients.
  <a href="http://pt.slideshare.net/denimgroup/developing-secure-mobile-applications-17732256" rel="nofollow">http://pt.slideshare.net/denimgroup/developing-secure-mobile-applications-17732256</a></p>