Edit Question - KnowledgeHub

Title Body

I have a REST service that's reasonably complete and will be used with an iOS app. It's built using Ruby/Sinatra but I don't think that really matters here. I'm using HTTP Basic Authentication over SSL for various endpoints and that part is working very well. Question is: How do I stop spammers etc from calling parts of the REST service that aren't protected via HTTP Basic Authentication? Example: User Registration Let's assume the REST call is (POST) .../register_account passing a JSON object in the body. For obvious reasons, this call cannot expect a username/password linked to a user account. Ideas are: 1) The app has its own 'username' / password and some calls would check for app-credentials. Problem: Rooting the device etc could unearth those credentials. 2) The app passes a secret token via a HTTP header to the REST Service for those calls. Problem: Same as (1) Are there any techniques commonly used out there to prevent such spam calls? I'm thinking maybe introduce the iPhone's device id in the mix but haven't identified a definite approach yet. Thanks

Tags (comma-separated) Cancel