Okay, I am developing an Application which requires getting sensitive information from a database and displaying it on an Android device. I have set up a HTTPS connection to the webserver, and used a HTTP GET request to a PHP script on the server. The PHP script connects to the database and prints the appropriate data from the database onto the page. My application then reads the contents of that page and displays it.
Is this an appropriate way to access and retrieve sensitive information, or should I use another method?
Many thanks.
This is a perfectly reasonable way of fetching the data from the server however to add security you may want to consider changing it to a POST request and then adding a variable that acts as a password that only the server and the client app ‘knows’. Therefore other users cannot request the page and find out the sensitive information. An alternative option would be to used OAuth.