How to prevent an authorized user from embedding my site in a mobile app

user_13716720 0
Viewed 36

I did a web app recently, my surprise! I saw it as a mobile app on someone's phone which is quite functioning very well, The person only knew the URL and nothing else.FIrstly, I thought it could be Iframe that the person used so I tried to prevent the site from being loaded in an iframe but it is still showing on that mobile app. Please what can I do?

laravel-8 angular reactjs php javascript
3 Answers

You can get the OS version & if it is Android or thing, then stop the rest of the functionalities. You can do this in 'onLoad' or using javascript later.

function getOS() { 

$user_agent = $_SERVER['HTTP_USER_AGENT'];

$os_platform =   "Bilinmeyen İşletim Sistemi";
$os_array =   array(
    '/windows nt 10/i'      =>  'Windows 10',
    '/windows nt 6.3/i'     =>  'Windows 8.1',
    '/windows nt 6.2/i'     =>  'Windows 8',
    '/windows nt 6.1/i'     =>  'Windows 7',
    '/windows nt 6.0/i'     =>  'Windows Vista',
    '/windows nt 5.2/i'     =>  'Windows Server 2003/XP x64',
    '/windows nt 5.1/i'     =>  'Windows XP',
    '/windows xp/i'         =>  'Windows XP',
    '/windows nt 5.0/i'     =>  'Windows 2000',
    '/windows me/i'         =>  'Windows ME',
    '/win98/i'              =>  'Windows 98',
    '/win95/i'              =>  'Windows 95',
    '/win16/i'              =>  'Windows 3.11',
    '/macintosh|mac os x/i' =>  'Mac OS X',
    '/mac_powerpc/i'        =>  'Mac OS 9',
    '/linux/i'              =>  'Linux',
    '/ubuntu/i'             =>  'Ubuntu',
    '/iphone/i'             =>  'iPhone',
    '/ipod/i'               =>  'iPod',
    '/ipad/i'               =>  'iPad',
    '/android/i'            =>  'Android',
    '/blackberry/i'         =>  'BlackBerry',
    '/webos/i'              =>  'Mobile'
);

foreach ( $os_array as $regex => $value ) { 
    if ( preg_match($regex, $user_agent ) ) {
        $os_platform = $value;
    }
}   
return $os_platform;
}

You could check the browser too

https://gist.github.com/Balamir/4a19b3b0a4074ff113a08a92908302e2

user_21260770

I hope this has convinced you to switch over to using iframes whenever adding untrusted content to your site. If set up properly, they provide the best protective separation between your content and third-party content, especially on new browsers that support sandboxing. Iframes are here to stay. Have any questions or other ideas about embedding third-party content? Sound off in the Hacker News comments.

Details log on: https://www.synopsys.com/blogs/software-security/protect-your-website-with-iframes/

user_178295270

AFAIK, if the webapp has the right properties and manifest, then, by design it can be run as a mobile app. Once such an app is running on a browser on the mobile, the browser displays a button to save/install it. Once saved, an icon shows up on the screen and it runs like an app. And it can also auto-update to the new version.

Therefore, one way to prevent this (I don't know why you would want to), is to write code in the app to detect what it is running on, and refuse to run on a mobile.

user_47794720
Related