iPhone 应用程序和 Web 服务器之间的安全连接？
我即将开始开发一个 iPhone 应用程序，该应用程序应该在应用程序和 Web 服务器之间安全地登录和通信信息。 我之前在这个领域没有做太多的开发，所以我做了一些研究，并且非常感谢任何关于如何以最好/最简单的方式处理这个问题的意见。
目前，开发 Web 服务器的人员不知道/没有一个系统来处理我将开发的应用程序的请求，因此他们很可能需要创建新的东西。
验证： 据我了解，使用 HTTP 身份验证根本不安全，最好的方法是使用 HTTPS？如果使用 HTTPS 或 HTTP，iPhone 应用程序会有什么区别？我想服务器和客户端都需要证书，苹果对使用 SSL 有何看法？
不管？我选择的，是这样的吗？： 1. 与服务器创建 NSURLConnection，监听 didReceiveAuthenticationChallenge 回调并使用用户/密码进行响应 2. 使用创建的连接发送任何其他信息？
与网络服务器的通信： 应用程序需要向服务器发送大约 20 个不同的请求，并需要对响应进行操作。 SOAP 或任何其他 Web 服务是处理这个问题的好方法吗？我相信 SOAP 基本上是基于 HTTP 的 XML，因此在应用程序中这应该像创建 NSMutableURLRequest 然后使用 XMLParser 解析响应一样简单？
或者还有其他更好的解决方案吗？
谢谢
I am about to start to developing an iPhone application that should login and communicate information securely between the app and a web server.
I haven't done much development in this area before, so I have done some research and would be very thankful for any input on how to handle this in the best/easiest way.
Currently, the people developing the web server does not know/have a system of handling requests from the application I will develop, so they will most likely need to create something new.
Authentication:
From what I understand, using HTTP authentication is not safe at all, and the best approach would be to use HTTPS? What would be the difference in the iphone application if using HTTPS or HTTP? I suppose the server and the client would need a certificate and what does apple think about using SSL?
Regardless? of what I choose, is this how it works?:
1. Create a NSURLConnection with the server, listen to the didReceiveAuthenticationChallenge callback and respond with the user/password
2. use the connection created to send any other information?
Communication with the webserver:
The application requires to send about 20 different request to the server and needs to act on the responses. Would SOAP or any other web service be a good way to handle this? I believe that SOAP is pretty much XML over HTTP, so in a application this should be as easy as creating a NSMutableURLRequest and then parse the response with an XMLParser?
Or is there another much better solution?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的。通过 HTTP 传输的数据以纯文本形式传输，这意味着您的密码、信用卡信息等在通过公共互联网传播时都可以被拦截。通过 HTTPS 传输的数据是加密的，因此只有客户端和接收服务器可以对其进行解码。
本质上没有区别。加密数据有一点开销，但不多。
是的，服务器需要 SSL 证书。 GoDaddy 的售价约为 25 美元/年。 Apple 完全同意您使用它们。
Yes. Data transferred over HTTP is transferred as plain text, which means your passwords, credit card info, etc. are all interceptable as they wind their way through the public Internet. Data transferred over HTTPS is encrypted, so only the the client and the receiving server can decode it.
Essentially no difference. There's a little overhead for encrypting the data, but not much.
Yes, the server would need an SSL certificate. GoDaddy sells them for about $25/year. Apple is perfectly fine with you using them.