I'm currently developing a web application which will serve data to iPhone clients. In order to be the owner of the data, I don't want other clients to be able to get it.
I thought I could use a shared secret key between the server and the clients : a hard-coded string that would salt the timestamp to ensure that the request has been done by one of my clients. So the request would look like this :
I would compute the hash like this in the app :
hash = sha(desired_object_id + device_id + timetsamp + "mysecretkey")
And on the server side, I'd just ensure that the hash was properly generated before sending the data. (all objects identified by "desired_object_id" are available to all the subscribers). As an alternative, I could also generate a random key rather than a timestamp.
The issue is that it doesn't sound secure to me... The data is not critical, it's just that I don't want to offer a public API used by non-subscribers. And doing this would also prevent me from changing the secret key, because this would force the users to update to a new client version (not very good for business...)
Is there any other known issue with this ? Is there a better way to do it ? Preferably with the same simplicity.