Home/ Questions/Q 6908835
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T08:36:46+00:00

I am building a RESTful API in Python with the Pylons framework, serving it

  • 0

I am building a RESTful API in Python with the Pylons framework, serving it with Apache2 and mod_wsgi, and would like to connect it to an iPhone app. I have very little experience with HTTPS, SSL, and certificate authorities, and I am wondering how I would go about securing my API.

How do I make sure that the API is being served through HTTPS? Is it necessary to, as in this example, set up an SSL certificate? If I sign an SSL certificate through an authority not recognized by iOS (CACert.org, for example, and mainly because it is free), will that affect my app’s ability to communicate with my server? How have others solved this problem of securing communications between a web-based RESTful API and iPhone apps?

Also, how does OAuth fit into all this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This really depends on what you mean by “securing” your API.

    Do you mean that you want to A) secure it so that unauthorized people are unable to access the API or B) do you mean that you want some level of encryption on the data passed back and forth between the client and server?

    If the answer is B or both, then you will definitely need to look at getting an SSL certificate and installing it on the server. Most certificate authorities have guides on how to do this.

    I’m not sure what you mean by “an authority not recognized by iOS” but you should still probably consider forking out the dough for a certificate from a recognized authority. It still wouldn’t hurt to try CACert.org though if they are offering free certificates. I can’t really see there being any problem in terms of the ability of communication between server and client being affected.

    In terms of securing your API from unauthorized clients, you could check out OAuth (see http://oauth.net/). There are various Python libraries for OAuth. Check out https://github.com/simplegeo/python-oauth2 for example. The only thing you may want to consider is that there is a reasonable learning curve when it comes to implementing OAuth.

    The second link above demonstrates a simple OAuth client and also has example code for a three-legged authentication process.

    • 0