Question

Let’s say I’m building an iOS application which needs to load some static JSON data updated now and then. Creating this JSON data requires a lot of effort, and the bandwidth also isn’t free.

I want to prevent other apps from piggybacking on my server and using my data.

I have tried encrypted zip files before, and it’s quite a hassle.

What are the best practices?

I realize there is no way to be 100% secure.

Answer 1

Encrypting the files is the best way. If security isn’t that important, put a magic value in the http requests, either in the URL or, better yet, in the header. For example, compute the hash of the date (at gmt), put it in the request headers, and have the server check it. It’s not really secure, won’t work on devices whose clocks are off, and you’ll probable want to accept yesterday, today, and tomorrow values for clocks that are slightly off, but it will stop casual downloading of your files.

Alternatively, you could implement a challenge-response system where the device makes a server request and the server returns one of 100 values. The client then does something special with that value (doubles it, hashes it with some salt, uses it in a table lookup, etc) and uses the result in the next server request.

The simplest/stupidest way is to just put a fixed magic value in the http header. It won’t stop a hacker for more than 10 minutes, but will stop some endusers using curl or wget to download your data.