Question

I am going about creating a service API to get latest articles from a database server into my iPhone app. In a simplistic way how can I go about making sure only my iPhone app is the consumer of the API and no other client can access it? I am not looking for a super secure solution but I just want to be able to put some level of firewall for incoming requests.
Also, any code snippets in PHP to enable this client side authentication?

Answer 1

There really isn’t a good easy way to lock down your API to limit it to requests coming from your application. You could do user agent checking, but that’s more trouble than it’s worth. You could pass a specific query string key/value pair (such as a UUID), but that’s easy to spoof, and wouldn’t provide any value.

If you’re willing to invest the time, there are other approaches that you can take that involve generating keys/tokens/nonces and checking them when the request is made to the server (Oauth is an example of this).

You should evaluate your requirements and decide how important it is that you protect your data. Given that you’re looking for an easy solution, I’m assuming the data isn’t really that important, and that all this work isn’t necessary.