Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
21 votes

How to safeguard a REST API for only trusted mobile applications

To anyone interested, on Android you CAN verify that the request you have gotten was sent from your app. In short, when you upload your app to google you sign it, with a unique key that known only to ...
ndori's user avatar
  • 327
9 votes

Why are there no cross-platform mobile applications?

As the co-founder of Codename One which does pretty much that I can answer that pretty easily. You can cross compile (which is what we do) but you can't have a single binary that will work everywhere ...
Shai Almog's user avatar
9 votes
Accepted

Data from devices with unreliable clocks

There's actually quite a bit you can do to recover something close to the actual time of most of your events. Android gives you a few useful tools to work with, notably broadcast intents sent when ...
Blrfl's user avatar
  • 20.4k
9 votes
Accepted

Keeping version parity between platforms

When most of your code base is shared for both platforms, I would avoid getting version numbers "out of sync", because it will bring a lot more effort for writing a coherent changelog or ...
Doc Brown's user avatar
  • 208k
8 votes
Accepted

Rest API calls with side effects on other resources

Problem A) Yes, that's fine. RESTful POSTs are permitted to generate side effects on other resources. I'd suggest breaking out messages from conversations in your URI hierarchy in this case, or ...
Eric Stein's user avatar
  • 3,572
8 votes

How can a website get the phone number of the device used to call it?

Basically your mobile phone company is adding your phone number to HTTP headers when you visit certain sites. So when you visit www.advertiser.com your request goes to your mobile phone operator, via ...
Ewan's user avatar
  • 76.3k
7 votes
Accepted

REST API Authentication: Cookie vs Web Storage

Use both. In your mobile app, you have better control over the code that runs and can avoid XSS vulnerabilities. So storing the token is not so problematic and you can have your code pass it to the ...
Ewan's user avatar
  • 76.3k
6 votes
Accepted

Two apps vs one app

Since there are no common features i suggest creating separate applications. That lets you update either app without confusing your users (e.g. updating an app without changing anything for the ...
marstato's user avatar
  • 4,608
6 votes

Proposed Method to Restrict API Access to Mobile App Only

Some comments Your mechanism relies upon the secrecy of an algorithm, a technique known as security through obscurity, which is almost universally deemed a bad idea. It is not likely you will be able ...
John Wu's user avatar
  • 26.5k
6 votes

Can you modify the front-end source code of a mobile app?

It's not just that people might be able to hack into your front-end app. They might be connecting directly to your server with an app that they wrote themselves. I can get around whatever security ...
gnasher729's user avatar
  • 45.7k
6 votes
Accepted

Why do some app makers limit their app to certain regions?

The dating app may be a good example here. First, when you start you typically do not have a lot of resources so immediate brought interest may bring the system to its knees and give users a bad ...
Martin Maat's user avatar
  • 18.4k
5 votes

If I develop a media player for mobile or desktop do I have to pay for a license if my player is able to read MP3 files?

I read quite a few forum topics and mailing list (link), the general answer was that if you are using the Android SDK, and you do not have an MP3 encoder/decoder in your application, then you don't ...
meskobalazs's user avatar
5 votes

REST vs RPC for mobile development

You might want to have a look at this article by Netflix about their API redesign: http://techblog.netflix.com/2012/07/embracing-differences-inside-netflix.html TL;DR: REST in general causes chatty ...
Dieter Van de Walle's user avatar
5 votes

Private apps for iOS and Android

You can develop and distribute private apps among selected clients. In iOS, ad-hoc distribution is there, but you'll need to hook up your mobile device to a Mac OSX. Ad-hoc distribution is possible ...
TroublingCushion's user avatar
5 votes

How to safeguard a REST API for only trusted mobile applications

As @Morons mentioned in his answer, it is very difficult to verify the entity at the other end of the connection. The simplest way to provide some level of authenticity is to have the server check ...
ThePragmatist's user avatar
5 votes
Accepted

Can you modify the front-end source code of a mobile app?

Yes of course. People like to think that because a lay person can't read the source code for compiled or even "transpiled" applications in the same way you can with javascript on a website that it's ...
Ewan's user avatar
  • 76.3k
5 votes

Vector graphics are smaller in file size and more scalable than raster, why vector graphics are not used more often in web and mobile app development?

Cameras don't draw. That is the by and large of it. Photo's are not drawn, and anything compositing a photo into it still has that not a drawing issue. Processing and Bandwidth aren't free A drawn ...
Kain0_0's user avatar
  • 16.2k
5 votes

How to estimate scaling up costs/resources-needed of a project?

If you ever get to the point where you've got 1,000 people using your app, you can hire some people who can get it to scale to 100,000. If you ever get to the point where you've got 100,000 people ...
Philip Kendall's user avatar
4 votes
Accepted

Architecture of badge system similar to StackExchange?

Your approach will work, and is probably the most common way of achieving this. If you've benchmarked it and it's too slow, there is a more efficient way, but it's much harder to implement. What you ...
Jules's user avatar
  • 17.8k
4 votes
Accepted

Fully API-based website - is it a good idea?

It sounds like you are talking about a 'single page app' This term is used to refer to websites where all or most of the actions you take are accomplished via client side javascript AJAX calls, ...
Ewan's user avatar
  • 76.3k
4 votes

What's the best implementation for offline mobile app synchronization?

If you're going to sync against your master SQL database you will always have the same problem: how do you resolve conflicting changes? CouchDB doesn't help you there. It explicitly does not handle ...
Joeri Sebrechts's user avatar
4 votes
Accepted

Is it good idea to save user/password and get token from server automatically behind the eyes of the user?

No, it is not a good idea to store the user's password. Saving the password is easy to get wrong and creates another attack vector (storage on mobile device). Though they shouldn't, many users use the ...
Kasey Speakman's user avatar
4 votes

Shoud I throw exceptions to UI layer or handle them in my VM layer

A login error is not unexpected. It is probable that unauthorised users might try to access the system. It is also possible ( even quite common ) that regular users make typos or even pick the wrong ...
Christophe's user avatar
  • 77.9k
4 votes

Architecture of mobile backend

An API is high level enough to expect it to do multiple things with a single action. If I have an endpoint that does a "Buy Product" then I would expect it to handle all of the transaction handling, ...
jakedipity's user avatar
4 votes

Different feature set in multiple mobile apps from the same code base

I don't know how modular the code is, but in order to handle the complexity of all of this it might be useful to create API layers. The core library has the features/functions in all apps, with ...
Berin Loritsch's user avatar
4 votes
Accepted

Creating an app with a secured performing service the Microsoft way

You're asking that a mobile app, without any physical security, serve as a trusted application within your overall solution. Sorry. There is no mechanism to ensure that trust, at least none that has ...
John Wu's user avatar
  • 26.5k
4 votes
Accepted

Proposed Method to Restrict API Access to Mobile App Only

Although it is certainly the case that generating a dynamic access key based on the IP address will improve protection, there are a number of problems with this approach: You can't actually assume ...
Richard Taylor's user avatar
4 votes
Accepted

What is done when an urgent fix for an app is needed but updates have to be approved by Apple/Google etc?

Your multiplayer software consists of client which is on the mobile device and service in internet. The service you host independently on the mobile vendors. The answer to your question is that you ...
max630's user avatar
  • 2,587
4 votes

Why local database should be the only source of truth for mobile application?

You need a single source of truth. Having a single source of truth that is always available is very handy. It really makes life easier if you use an always available database as single source of ...
gnasher729's user avatar
  • 45.7k

Only top scored, non community-wiki answers of a minimum length are eligible