Home/ Questions/Q 64775
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-10T18:50:34+00:00

I’m working on a REST service that has a few requirements: It has to

  • 0

I’m working on a REST service that has a few requirements:

  1. It has to be secure.
  2. Users should not be able to forge requests.

My current proposed solution is to have a custom Authorization header that look like this (this is the same way that the amazon web services work):

Authorization: MYAPI username:signature

My question is how to form the signature. When the user logs into the service they are given a secret key which they should be able to use to sign requests. This will stop other users submitting requests on their behalf, but will not stop them forging requests.

The application that will be using this service is an iPhone application, so I was thinking we could have a public key embedded in the application which we can do an additional signature with, but does this mean we’ll have to have two signatures, one for the user key and one for the app key?

Any advice would be greatly appreciated, I’d quite like to get this right the first time.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. I think the simplest way to do this right would be to use HTTPS client authentication. Apple’s site has a thread on this very subject.

    Edit: to handle authorization, I would create a separate resource (URI) on the server for each user, and only permit that (authenticated) user to manipulate this resource.

    Edit (2014): Apple changed their forum software in the past six years; the thread is now at https://discussions.apple.com/thread/1643618

    • 0