Question

I’m using a public API for my web app and iPhone app. My app performs basics CRUD operations into a database.

As the client key of the API is sent in the HTTP request header, it will be easy for malicious users to dump that key and tamper datas initially passed to the request (with the Tamper Data Firefox plugin for example)

So here’s my simple question : what are the best practices for being protected from this ?
How can I programmatically detect the different cheating cases before sending datas to the database ?

Answer 1

Serving your webservice in HTTPS rather than HTTP would prevent anyone from sniffing your key on the wire.