CODEWITHSUNDEEP
iosauthenticationhttpipad
Ben Hoyt
Ben Hoyt

Reputation: 11044

How to determine whether HTTP API request came from iPad

We're developing an HTTP API for an iPad app, and we're thinking of only allowing the API to be accessed via an HTTP request that came from an iPad.

I'm not thinking of something like the User-Agent, because that can easily be forged, but more like some kind of authentication scheme that ties in with the App Store? Maybe the App Store signs each app with some kind of private key, and then you could insert that signature as a query parameter or header in the request and check on the server side whether the signature is from a legit iPad.

Is something like this possible or even a good idea?

Upvotes: 0

Views: 412

Answers (1)

highlycaffeinated
highlycaffeinated

Reputation: 19867

If you control both the iPad app and the server app, you should be able to use PKI to validate that a request came from a legitimate app. Embed the public key in the app itself, use it to encrypt a value you put in a header field, and then use the private key on the server to decrypt and validate the received header value.

Upvotes: 1

Related Questions