I have a PHP server with some .php files. Swift iOS application send POST request to server and get some response in JSON. PHP files on server do some work with MSQL.

The question is:
How to provide good security when do some request?

I thinking to create some let API_KEY = "dakhye8k3id9" and send it with request to server. But is it secure? (Decompilers etc.). Maybe there is some other approach?

To give some string tokens is also not good idea because I store it in NSUserDefaults.

I am talking about call API from PHP server. In API I have request which add subscription to user. And parameters - userId and subscId. Anyone can add subscription knowing their userId and sbscId.

  • do you want to secure the call from the app to the API? (looks so from the first part of the question) Or a call from your server (looks so from the last paragraph)? is there some authentication in place?
    – WoJ
    Jul 9 '15 at 20:25

There are already a number of standard solutions for this type of problem, such as Javascript Web Tokens. The architecture for most of these solutions is fairly straight forward - you have an authentication service which authenticates the user and returns a unique token which is encrypted and contains information your service requires. The server owns the private key for this token. Your client then makes API calls and passes the token as a parameter in the API call. The service uses the private key to verify the token and possibly extracts additional detail from the toekn to verify authorisation etc. Often the token will have an expiration date as well as other data. What this additional data might be will depend on your application and what requirements you have. The critical component is to ensure your private key used to encrypt the token is secure.

It is also important to ensure whatever solution you adopt, that it fits with your application. The level of security you need will depend on your risk assessment and the extent to which things need to be protected. There is nothing worse for the user than being required to go through too much security compared to the value of the service being offered.

I would also recommend using an existing, well tested and understood solution rather than trying to re-invent the wheel. There are a number of libraries for both servers and clients to handle this type of requirement. These are not guaranteed to be 100% secure (nothing ever is). For example, there has been recent posts regarding security issues with JWT libraries. However, the fact that these frameworks are being tested and examined for security weakensses means you will likely get a better end result than writing something yourself which is not getting that added attention.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.