title: How avoid man-in-the-middle attack when using Google Cloud Endpoints?
body: <p>I'm currently writing my first android app and decided to use google cloud endpoints.
  I have secure my backend endpoints methods by following this docs : <a href="https://cloud.google.com/appengine/docs/java/endpoints/auth" rel="nofollow">https://cloud.google.com/appengine/docs/java/endpoints/auth</a>,
   <a href="https://cloud.google.com/appengine/docs/java/endpoints/gen_clients" rel="nofollow">https://cloud.google.com/appengine/docs/java/endpoints/gen_clients</a>, <a href="https://cloud.google.com/appengine/docs/java/endpoints/consume_android" rel="nofollow">https://cloud.google.com/appengine/docs/java/endpoints/consume_android</a></p>
  
  <p>Basically you have to generate WEB_CLIENT_ID and ANDROID_CLIENT_ID for your endpoints,
  add a param User on each method you want to secure and finally check inside the method that 
  the user is not null otherwise throw OAuthRequestException.</p>
  
  <p>I have build the client android library and configure it like this in my android app :</p>
  
  <pre><code>SharedPreferences preferences = PreferenceManager.getDefaultSharedPreferences(context);
  String accountName = preferences.getString(MainActivity.PREF_ACCOUNT_NAME, null);
  
  GoogleAccountCredential credential = GoogleAccountCredential.usingAudience(context,
                          "server:client_id:xxxxxxxxx-xxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com");
  
  credential.setSelectedAccountName(accountName);
  
  DataLoaderApi.Builder builder = new DataLoaderApi.Builder(AndroidHttp.newCompatibleTransport(),
                          new AndroidJsonFactory(), credential);
  </code></pre>
  
  <p>At first it seems to work pretty well you cannot use the backend methods without credential. (You will have 401 error)</p>
  
  <p>Unfortunately I notice that it's still possible to decrypt https request/response to backend endpoints if you use a tool like "Charles Proxy"
  (<a href="https://www.charlesproxy.com/" rel="nofollow">https://www.charlesproxy.com/</a>). You just have to install charles proxy certificate in your smartphone and configure the proxy.</p>
  
  <p>Here's another description of the same problem:
  <a href="http://nickfishman.com/post/50557873036/reverse-engineering-native-apps-by-intercepting-network" rel="nofollow">http://nickfishman.com/post/50557873036/reverse-engineering-native-apps-by-intercepting-network</a></p>
  
  <p>Now you have the endpoints url used by the android app, you've got all the param sent in each request and all the header properties even the autorization property 
  with the token so basically all the informations you need to use my backend endpoints in your app. :(
  I know the token will expire after a while but in the meantime you can extract my datas. </p>
  
  <p>Google speak about that in the google cloud store doc :
  <a href="https://cloud.google.com/storage/docs/concepts-techniques#bestpractices" rel="nofollow">https://cloud.google.com/storage/docs/concepts-techniques#bestpractices</a></p>
  
  <p>"Make sure that you use an HTTPS library that validates server certificates. A lack of server certificate validation makes your application vulnerable to man-in-the-middle attacks or other attacks."</p>
  
  <p>Great but when you use the endpoints client library generated with their tool you are vulnerable too. </p>
  
  <p>I know there are solution to avoid this problem:
  <a href="https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning" rel="nofollow">https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning</a> </p>
  
  <p>But how can I use the generated endpoints client android library and avoid man-in-the-middle attack ?</p>