安全的 iPhone (iOS)/服务器通信
我正在构建 iPhone 应用程序，它将向服务器上运行的我的应用程序发出请求。我正在使用 REST 来构建服务器的应用程序 API。保护从 iPhone 到服务器的请求的最佳方法是什么，反之亦然。 OAuth 是一个好的选择吗？你会推荐什么？
谢谢！
I'm building and iPhone App that will make requests to an application of mine running on a server. I'm using REST to build the server's application API. What is the best way for securing the requests from the iPhone to the server and viceversa. Is OAuth a good option? What would you recommend?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果它是您控制的服务器，请使用 SSL/TLS 连接进行电话和服务器之间的所有通信。确保电话应用程序代码检查服务器的证书（例如，检查它是否是您的域名的证书，其中您的域名被硬编码到源代码中）。这将防止窃听、中间人攻击、消息伪造以及数据传输过程中的其他攻击。
If it's a server you control, use a SSL/TLS connection for all communications between the phone and your server. Make sure that the phone app code checks the server's certificate (e.g., to check that it is a cert for your domain name, where your domain name is hardcoded into the source code). This will protect against eavesdropping, man-in-the-middle attacks, message forgery, and other attacks on the data while it is in transit.
如果没有关于应用程序安全需求的更多信息，实际上没有任何方法可以回答“什么是最好的”问题。
一般来说，您应该考虑身份验证、授权和传输。
身份验证可以像用户名/密码登录一样简单。这可以是简单的身份验证、OAuth、kerberos 等。它旨在识别用户。授权涉及允许哪些团体或个人访问哪些服务。您需要一种授予和维护权限的方法。最后，保护传输通常意味着使用加密服务，例如基于 SSL 的 HTTPS。这可以防止数据在传输过程中被拦截或更改。
还有许多其他考虑因素需要考虑，包括如何保护个人身份信息、加密等，但同样，没有可以推荐的万能解决方案。
There is not really any way to answer the question "what's best" without a lot more information on the security needs of your app.
In general, you should consider authentication, authorization, and transport.
Authentication could be as simple as username/password login. This could be simple authentication, OAuth, kerberos, etc. It is meant to identify the user. Authorization deals with which services are allowed to be accessed by which groups or individuals. You'd need a way to grant and maintain privileges. Finally, securing the transport typically means using encrypted services, such as HTTPS over SSL. This prevent data from being intercepted or altered during transport.
There are many other considerations to think about including how your protecting personally-identifiable information, encryption, etc., but again, there is no one-size-fits-all solution that could be recommended.