App/device attestation for backend requests from a webOS TV web app — any supported mechanism?

Web App Development
1

Hi,

Any App attestation mechanism I can use to call my backend?
app signing exposed at runtime, hardware keys from DRM?, any client-cert support in the webview, or secrets baked in the IPK are extractable?

Is there any Luna API that returns a server-verifiable, LG-signed device/app token?

Or is server-side session verification the intended ceiling?

Thanks
Sportvibez Team

2

You can use Device Unique ID API. LGUDID is generated using MAC as a seed. Thank you.

3

So I can send the UUID from the TV when I call my backend servers, then I can verify this UUID server side by calling and verifying with luna://com.webos.service.sm? Did I get this correctly?

4

No, the Luna Service API is only avaliable in webOS TV apps. The Device Unique ID API is can be used for device identification/authentication, but it is up to you how to utilize the API in your app. Thank you.