c# - How to Grant Angular Authorization to my REST API Calls for Mobile App -

i have c# azure web api backend data retrieved front-end ionic mobile app (which angular app)

the authorization of users done via ionic's cloud service, handle heavy lifting of registering users via fb, twitter, basic (username/password).

my question is, when go call services backend api, how can make sure doesn't read hardcoded username/password inside of internal javascript code access backend data?

i know it's pretty far fetched, there anyway api know request coming app (android , ios) , not trying insert data , comments web browser unauthorized?

since you're calling api javascript available end users, can assume javascript , logic/credentials contained within accessible all.

there secure ways around this, , fb/twitter , ilk have implemented (using oauth). essentially, on passing credentials api, token generated, used subsequent calls api instead of credentials.

you can avoid people randomly firing off 'unauthorized' requests using nonces generated when render form, , can used once submit form in question. can time-limit validity of nonce on api end. unfortunately, it's not foolproof, limit damage of sort of 'brute-force' attack might get.

again, shared 'secret' (that guarantee origin of requests), have assume enough willpower able extract apps, method implement here 100% foolproof. best can have shared secret generated each user on each device.