I have a ASP.NET/IIS server. I want to restrict my server to only accept request from Android and Iphone(IOS) applications. I have heard about HMAC. Can HMAC help me?
Sorry, HMAC won't do what you want. Your best solution would be to use a challenge response scheme (assuming it is an android/iOS mobile app accessing your server). Have obscured code in your app to respond to a challenge request using a hidden algorithm. An attacker could decompile the app, but it is the closest solution to what he/she is requesting.
If the communication is through a mobile webpage then this approach won't work.
Like other answers have said, you can't trust user input (headers). They are trivial to spoof.
HMAC is a cryptographic concept for assuring the integrity and source (authentication) of information. This isn't really applicable for what you are trying to do.
Really, there's no way to ensure a request is coming from a specific platform, this is because the host receives this information from the client. A client can send whatever information it wants by manipulating (spoofing) the HTTP Headers, specifically the User-Agent field.
Bottom line, you can not trust user (client) supplied information.
In principle, impossible. In practice, you can use some platform specific tricks like for android. 1. Push an expiring token from GCM https://developer.android.com/google/gcm/index.html to device. 2. The request should contain the token.
The token can be time dependent, android id dependent or both. In such case, the person needs a device to get the token and send the requests. At least, you will know who is making the requests and can block the person if needed.