CODEWITHSUNDEEP
ios
inforeqd
inforeqd

Reputation: 3249

iOS creating secure token based communication between application and server

For an ios 5.0 application connecting to a rest webservice, the customer wants to implement a token based security to ensure that the data being sent over the network is not intercepted and altered in any way... Doesn't https over ssl ensure that the data is not intercepted? and I thought that this would be enough. Pls advise

However, The way the client wants it to work is that starting with the first client authentication request the server would return a token id that would be used to send the next request. In the response for this next request another token id would be sent back that needs to be used for the next request and so on. The problem is of concurrency. Eg when the apns token comes back and the app has to send that to the server and if at that time the iOS application is already making a data request to the server, then the tokens to be used will not match. also since the app has to regularly poll the server for new items, then there are more chances of such concurrency issues to occur.. Any ideas what efficient solutions I can put in the app to counter this?

Or if anyone can suggest better ways of implementing security over the network data, as a possible alternative to the above approach.. solutions that would work for an iOS app and is not battery consuming?

Help in this would be greeeeaaatly appreciated! :-)

Ps. Jfyi Am already doing md5 security on the token being sent

Upvotes: 1

Views: 719

Answers (1)

janfrode
janfrode

Reputation: 348

Doesn't https over ssl ensure that the data is not intercepted?

It depends on whom you're trying to protect agains. Plain SSL will protect perfectly fine against anyone between the device and the server.

But it will be trivial for the device owner to create a man-in-the-middle against a client that trusts all CA's on the device. All he needs to do is install his own private CA-certificate on the device, issue a fake certificate for your server signed by this CA, and install this certificate on his proxy/MitM device. To avoid this attack you'd need to do certificate pinning in the App.

Upvotes: 3

Related Questions