Question

I’d like to make requests from an iphone app to a web service I’ve built. How can I verify that requests made to the web service come from my iphone app (or indeed any authorised source) and are not forged?

I have looked at basic auth over HTTPS but is baking credentials into an application secure?

This question isn’t really iphone specific; I’d like to know how to protect and authenticate requests in general.

Answer 1

Authentication can be asserted by presenting something you know, something you have, something you are or a combination of the three.

The iPhone doesn’t have retinal or fingerprint scanners, so there are no “something you are” options available.

Client certificates work well as a “something you have” token. Most smartcards work by signing a message with an embedded certificate. When a certificate is compromised, it can be put onto a Certificate Revocation List (CRL) referenced by the webservers. Obviously, you wouldn’t want to put your app’s embedded certificate in the CRL — that would deny access to all your users. Instead, you’ll want users to download individual certificates to their iPhone.

After that, it’s a matter of monitoring for unusual behavior to find the bad actors and adding those certs to the CRL. Two dead giveaways would be clients who send too many requests at once or from too many different IPs in too short a time.

Login/password is a simple “something you know” token. Like certificates, login/password combinations can be compromised and similar monitoring can be set up to find inappropriate behavior. The difference is compromised accounts would be marked “blocked” rather than added to a CRL.

By requiring both a client certificate and a login/password you increase the amount of effort needed to compromise an account.

Of course, you must ensure only valid accounts are added to the database. If there is an automated way to create new accounts and corresponding client certificates, then that account creation server/process becomes the easiest way for bad actors to create viable, unauthorized accounts. Requiring a real person to sign-off on accounts removes the automation process, but means a disgruntled or corrupt employee could create invalid accounts. Requiring a second person to counter-sign the account makes it harder for a single person to be an inside threat.

In short, ensuring high integrity of the clients is a process that can be made arbitrarily complex and expensive. What tools and processes you decide to deploy as the authentication scheme has to be balanced by the value of what it is protecting.