1

I have an application that I am writing for both iOS and Android; this application will be served by a ReSTFUL API running on a cluster of servers on "the internets". I am curious how the rest of the world is going about securing their APIs so only specific applications running on iOS or Android can use these APIs.

I could go the same route as other OAuth providers by providing a key/secret combination (2-legged OAuth), however, what do I do if I ever have to change these keys??? Do I create a new key/secret for every person that downloads the app???

The application is a social-based game that will allow the user to interact with other "participants" in the game based on location, achievements, etc.

The API will provide the following functions:

-Questions, Quests, etc -Profile Management -User Interaction -Possible Social Interaction

Once the app gains traction I plan on opening up the API ala Facebook, Twitter, etc. Which is easy enough, I plan on implementing an OAuth Server and whatnot. However, I want to make sure, during this phase, that only people who are using the application can access and use the API.

Improve this question
5
  • Really need some details about what your app is doing and what needs to be secured -- could be tricky. Or not.
    – Wyatt Barnett
    Jun 18, 2012 at 15:07
  • well... the application is a social-based game that will serve up questions, other users responses, manage user profiles, user interactions, etc.
    – El Guapo
    Jun 18, 2012 at 15:14
  • Ok, you might want to add that to the question . . ..
    – Wyatt Barnett
    Jun 18, 2012 at 15:15
  • This is the basis of a good question, and not necessarily specific to iOS / Android. Any WebApp developer will potentially need to address this issue. More details please, so a solid question can be formed.
    – user53019
    Jun 18, 2012 at 15:33
  • 1
    Sure... give me a bit and will update the question and tag it properly
    – El Guapo
    Jun 18, 2012 at 15:34

1 Answer 1

Reset to default
1

There is no way you can be sure that the application at the far end of the wire is the one you think it is. You can't prevent someone reverse-engineering the communications and API and running their own app. You can (of course) make it difficult, for example by encrypting the traffic, and by making the protocols difficult to emulate even if decrypted.

Improve this answer
1
  • I think what I may do is follow the 2-legged OAuth paradigm and produce one set of keys/secrets that all of "my users" (the devices that download my app) will use and version the key/secret combination... if I need to invalidate that key/secret I can and then the next time one of the units tries to communicate I can just regenerate them
    – El Guapo
    Jun 20, 2012 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.