1

This is a similar situation to the one raised in this question: Javascript Calling a Rest API with App Name and App Password - How Can i Secure it

Here is the architecture overview:

  • The site is Html5/jquerymobile
  • It contacts what I call a "Wrapper" service.... This is a REST API I wrote in C#, to contact another 3rd party REST API. I do this because there are credentials in the Header and the API uses Basic Authentication. Credentials are therefore not publicized as they are only known server-side.
  • My "Wrapper" service does not currently implement any additional security. It is currently accessible from anywhere. The easiest and quickest way to lock it down is to restrict by IP, so no other IP anywhere except the server can actually contact my wrapper service.

The questions: Is the locking by IP the only way to ensure that the API won't get hammered if it was otherwise accessible from anywhere?

If I convert this using Phonegap (which I have... and deployed successfully on Android), obviously the native app won't work if the web service is restricted.
Is there a way around this so I can allow traffic only from the mobile app, and not from any other source? I'm thinking along the lines of MD5 hash or something that could be sent to the wrapper API.. but unfortunately I'm thinking that info can easily be "sniffed".

Is my only viable option here to release the app as a web app, forcing browser use, thereby removing any concerns about allowing my web service to be hammered??

Community
  • 1
  • 1
collumbo
  • 517
  • 3
  • 6
  • 22

1 Answers1

1

I believe the answer to this is a combination of a user token and encrypting the message through SSL.

The server can issue a valid user a token so we can identify him in future requests.

Encrypting it via SSL will ensure that this token cannot be sniffed.

https://security.stackexchange.com/questions/12531/ssl-with-get-and-post

Community
  • 1
  • 1
Paolo del Mundo
  • 2,121
  • 13
  • 18