如何控制对服务器端数据的访问？
我创建了一个 iPhone 应用程序，它以 XML 文件的形式获取服务器上保存的数据。如何检查数据请求是否来自我的应用程序，而不是来自其他来源（例如另一个 iPhone 应用程序或桌面浏览器），因为目前您可以使用 Wireshark 跟踪 LAN 上的 iPhone 请求，然后使用捕获的 URL在桌面浏览器中加载数据。我想我需要通过 PHP 或其他方式提供文件，并使用某种用户代理验证或质询响应序列。如果有人可以提供代码示例，我将不胜感激。
I have created an iPhone application which fetches data held on a server in an XML file. How do I check that the request for the data is coming from my app and not from some other source such as another iPhone app or a desktop browser since currently you could just trace the iPhone request on your LAN with Wireshark and then use the captured URL to load the data in a desktop browser. I'm thinking I'm going to need to serve the file via PHP or something and use some sort of User Agent validation or a challenge-response sequence. If someone could provide a code sample I'd appreciate it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
简短的回答：你不能。但你确实可以让它变得更难。
无论你做什么，都有可能规避它——用户代理验证非常容易规避；挑战响应将需要反汇编您的应用程序，但这仍然是可能的。
然而，所有好的保护措施都无助于防止网络嗅探。除非您也对传输进行加密，否则有人可以简单地嗅探明文数据，而不会破坏您的“保护”。
在我看来，主要问题不应该是“我如何保护它”，而应该是“为什么有人想要获取原始数据？为什么他不应该获取它？”
Short answer: You can't. But you can indeed make it harder.
Whatever you do, it will be possible to circumvent it - user agent validation is extremely easy to circumvent; challenge-response will require disassembling of your app, but it's still possible.
However, all your nice protections won't help against network sniffing. Unless you also encrypt the transfer someone can simply sniff the plaintext data instead of breaking your "protection".
IMO the main question shouldn't be "How do I protect it" but rather "Why would somebody want to get the raw data? Why shouldn't he get it?"