Limit inbound traffic to iOS and Android

Question

I have a native mobile application for both iOS and Android platforms with back-end in Java (Hibernate and Spring). I and am using Amazon Web Services. Is there a way to limit inbound traffic to requests coming from the native applications? Basically, I want to make sure users cannot make any requests from browsers.

Answer 1

You cannot use a security group to prevent connections from undesirable clients from getting to your application. When you open a CIDR+port in the security group, it allows all traffic from that CIDR on that port through to your app server, no matter what the client is.

You can implement an authentication scheme whereby you could identify requests from your desirable clients, but not process "unauthorized" requests. Probably any such scheme would be vulnerable to spoofing and not something that you could rely on 100%.