21
votes
How to safeguard a REST API for only trusted mobile applications
To anyone interested, on Android you CAN verify that the request you have gotten was sent from your app.
In short, when you upload your app to google you sign it, with a unique key that known only to ...
- 327
9
votes
Why are there no cross-platform mobile applications?
As the co-founder of Codename One which does pretty much that I can answer that pretty easily.
You can cross compile (which is what we do) but you can't have a single binary that will work everywhere ...
- 191
9
votes
Accepted
Data from devices with unreliable clocks
There's actually quite a bit you can do to recover something close to the actual time of most of your events.
Android gives you a few useful tools to work with, notably broadcast intents sent when ...
- 20.3k
9
votes
Accepted
Keeping version parity between platforms
When most of your code base is shared for both platforms, I would avoid getting version numbers "out of sync", because it will bring a lot more effort for writing a coherent changelog or ...
- 203k
8
votes
Accepted
Rest API calls with side effects on other resources
Problem A) Yes, that's fine. RESTful POSTs are permitted to generate side effects on other resources. I'd suggest breaking out messages from conversations in your URI hierarchy in this case, or ...
- 3,542
8
votes
How can a website get the phone number of the device used to call it?
Basically your mobile phone company is adding your phone number to HTTP headers when you visit certain sites.
So when you visit www.advertiser.com your request goes to your mobile phone operator, via ...
- 72.4k
7
votes
Accepted
REST API Authentication: Cookie vs Web Storage
Use both.
In your mobile app, you have better control over the code that runs and can avoid XSS vulnerabilities. So storing the token is not so problematic and you can have your code pass it to the ...
- 72.4k
6
votes
Accepted
Two apps vs one app
Since there are no common features i suggest creating separate applications. That lets you update either app without confusing your users (e.g. updating an app without changing anything for the ...
- 4,548
6
votes
Proposed Method to Restrict API Access to Mobile App Only
Some comments
Your mechanism relies upon the secrecy of an algorithm, a technique known as security through obscurity, which is almost universally deemed a bad idea.
It is not likely you will be able ...
- 26.2k
6
votes
Can you modify the front-end source code of a mobile app?
It's not just that people might be able to hack into your front-end app. They might be connecting directly to your server with an app that they wrote themselves.
I can get around whatever security ...
- 43.6k
6
votes
Accepted
Why do some app makers limit their app to certain regions?
The dating app may be a good example here. First, when you start you typically do not have a lot of resources so immediate brought interest may bring the system to its knees and give users a bad ...
- 18.3k
5
votes
REST vs RPC for mobile development
You might want to have a look at this article by Netflix about their API redesign:
http://techblog.netflix.com/2012/07/embracing-differences-inside-netflix.html
TL;DR:
REST in general causes chatty ...
5
votes
Private apps for iOS and Android
You can develop and distribute private apps among selected clients.
In iOS, ad-hoc distribution is there, but you'll need to hook up your mobile device to a Mac OSX. Ad-hoc distribution is possible ...
5
votes
How to safeguard a REST API for only trusted mobile applications
As @Morons mentioned in his answer, it is very difficult to verify the entity at the other end of the connection.
The simplest way to provide some level of authenticity is to have the server check ...
- 151
5
votes
Implementing a method that never returns the same data twice
Why not consider
3. Send a userID and let the server figure out what to send.
This will optimize network traffic in a big way - you're always sending the server a single piece of information of ...
- 13.8k
5
votes
If I develop a media player for mobile or desktop do I have to pay for a license if my player is able to read MP3 files?
I read quite a few forum topics and mailing list (link), the general answer was that if you are using the Android SDK, and you do not have an MP3 encoder/decoder in your application, then you don't ...
- 161
5
votes
Accepted
Can you modify the front-end source code of a mobile app?
Yes of course.
People like to think that because a lay person can't read the source code for compiled or even "transpiled" applications in the same way you can with javascript on a website that it's ...
- 72.4k
5
votes
Vector graphics are smaller in file size and more scalable than raster, why vector graphics are not used more often in web and mobile app development?
Cameras don't draw.
That is the by and large of it. Photo's are not drawn, and anything compositing a photo into it still has that not a drawing issue.
Processing and Bandwidth aren't free
A drawn ...
- 16.1k
5
votes
How to estimate scaling up costs/resources-needed of a project?
If you ever get to the point where you've got 1,000 people using your app, you can hire some people who can get it to scale to 100,000.
If you ever get to the point where you've got 100,000 people ...
- 23.3k
4
votes
Accepted
Is it correct to implement all the payment flow in the client rather than in the server?
I Haven't used mango pay but usualy these things work in three parts:
client redirects user to third party payment app. eg paypal or 3d secure
third party tells client payment has been made
third ...
- 72.4k
4
votes
Accepted
How to deprecate an entire mobile application?
If you're decommissioning the backend and making the app unusable, then you should provide the users an update which notifies them of the service being decommissioned. Give them a fixed date for when ...
- 166
4
votes
Accepted
Architecture of badge system similar to StackExchange?
Your approach will work, and is probably the most common way of achieving this. If you've benchmarked it and it's too slow, there is a more efficient way, but it's much harder to implement.
What you ...
- 17.7k
4
votes
Accepted
Implementing a method that never returns the same data twice
If you have full control over the ID generation and the order in which content is presented, then it must be possible to guarantee that if I am looking at the ContentItem with ID 42, then I have ...
- 73.3k
4
votes
Accepted
Fully API-based website - is it a good idea?
It sounds like you are talking about a 'single page app'
This term is used to refer to websites where all or most of the actions you take are accomplished via client side javascript AJAX calls, ...
- 72.4k
4
votes
What's the best implementation for offline mobile app synchronization?
If you're going to sync against your master SQL database you will always have the same problem: how do you resolve conflicting changes?
CouchDB doesn't help you there. It explicitly does not handle ...
- 12.9k
4
votes
Accepted
Is it good idea to save user/password and get token from server automatically behind the eyes of the user?
No, it is not a good idea to store the user's password. Saving the password is easy to get wrong and creates another attack vector (storage on mobile device). Though they shouldn't, many users use the ...
- 4,361
4
votes
Shoud I throw exceptions to UI layer or handle them in my VM layer
A login error is not unexpected. It is probable that unauthorised users might try to access the system. It is also possible ( even quite common ) that regular users make typos or even pick the wrong ...
- 75.9k
4
votes
Architecture of mobile backend
An API is high level enough to expect it to do multiple things with a single action. If I have an endpoint that does a "Buy Product" then I would expect it to handle all of the transaction handling, ...
- 354
4
votes
Different feature set in multiple mobile apps from the same code base
I don't know how modular the code is, but in order to handle the complexity of all of this it might be useful to create API layers. The core library has the features/functions in all apps, with ...
- 46k
Only top scored, non community-wiki answers of a minimum length are eligible