I have a REST service that's reasonably complete and will be used with an iOS app. It's built using Ruby/Sinatra but I don't think that really matters here.
I'm using HTTP Basic Authentication over SSL for various endpoints and that part is working very well.
Question is: How do I stop spammers etc from calling parts of the REST service that aren't protected via HTTP Basic Authentication?
Example: User Registration
Let's assume the REST call is (POST) .../register_account passing a JSON object in the body.
For obvious reasons, this call cannot expect a username/password linked to a user account.
Ideas are:
1) The app has its own 'username' / password and some calls would check for app-credentials. Problem: Rooting the device etc could unearth those credentials.
2) The app passes a secret token via a HTTP header to the REST Service for those calls. Problem: Same as (1)
Are there any techniques commonly used out there to prevent such spam calls? I'm thinking maybe introduce the iPhone's device id in the mix but haven't identified a definite approach yet.
Thanks