CODEWITHSUNDEEP
iosauthentication
Ankit Srivastava
Ankit Srivastava

Reputation: 12405

How to achieve client validation in iOS?

How to verify if the API being hit is from the actual application and is not going through any MITM attacks.

I understand SSL certificates can be used to achieve transport level security and the app can be sure it is taking to the correct server, but how can I attain the same thing from app side.

I just want to make sure that only my app is hitting my services and the hit is not coming from somewhere I don't trust.

Thanks

Upvotes: 1

Views: 55

Answers (2)

Hans Sjunnesson
Hans Sjunnesson

Reputation: 22309

The same way that the client validates the server based on its server certificate, SSL supports the server issuing client certificates and requiring communication to be signed with that specific certificate.

With this approach it comes down to possession of the certificate rather than, say, knowledge of a password. Which in the case of mobile is problematic, because an attacker can more easily gain physical access to your device and read your app's documents. So take care to store your keys in your keychain.

Also, your method of handshaking with your server and asking it to issue a client certificate becomes a security bottleneck. An attacker could, since she has physical access to the device, sniff the traffic and easily figure out the API calls needed to get the server to issue the proper certificate.

Read Apple's business oriented document on security in iOS here.

Upvotes: 0

Tobi Nary
Tobi Nary

Reputation: 4596

Have a look at SSL again - it offers client certificates, for example, to do so. Yet, this only shifts the problem as an attacker might use the same mechanism the apps use to get certificates. (An shared API token is often considered okay as well and much easier to implement.)

In general, you cannot achieve a guarantee for that. You might get a good result by issueing certificates based on user authentication by external means (e.g. make users put in their user names and passwords) or make it hard for adversaries to abuse your API by using reverse turing tests (e.g. completely automated programms to tell computers and humans apart, aka CAPTCHAs).

Upvotes: 1

Related Questions