Prevent "fake-client" for ios app

Question

We have an android and ios app which sends data and commands to a server with http webservice. How can i prevent the possibility, that fake-clients also can send something to the server? How can I determine serversidely if the data/command really comes from our apps.

Answer 1

You cant really prevent it. There are several techniques to make it harder for people abusing your services.

A simple check can be to check the user agent calling your webservice. Another pretty common one is to use a simple authentication via user/password authentication on your webserver. The username and password will be embedded into your app.

If you have enough time you should think about using a combination of this two methods plus authentication with a embedded ssl certificate. You simply could add this to your project and if someone really want to abuse your service, he have to extract this certificate atleast form your application.

There are some other useful techniques but you cant prevent reverse engineering or network sniffing.

Sincerely, fuxx