限制服务器只响应来自 iOS 应用程序的 HTTP 请求 - 没有用户名和密码

Question

I have an iOS app where the user can makes HTTP requests from their phones and the HTTP returns information based on the zip code that the user provides through the phone.

My issue is that anyone can type the URL and the server would respond with the information that corresponds to the zip code they input eg http://example.com/zip-code/78515 .

My questions is, can I limit the server to only respond to requests made from my iOS app without the user having to create a user and password? In other words, if someone types http://example.com/zip-code/78515 directly in a browser I want the server to ignore the request but if the request comes from my iOS app I want the server to respond accordingly.

For the HTTP request I'm using Laravel.

Here is my Laravel code.

Route:

Route::get('zip-code/{zipCode}', 'AppsAPIController@information');

Controller:

class AppsAPIController extends Controller
{
        public function information($zipCode)
        {     
            $info = CityInfo::where('ZipCode', $zipCode)->get();
            return ($info);
        }
}

Request:

http://example.com/zip-code/78515

Again, the question is, how can I limit the server to only respond to requests made from my iOS app without the user having to create a username and password?

Answer 1

This package seems to do that

https://github.com/spinen/laravel-browser-filter

Basically, you are adding a middleware that reads the user agent out of the request, and denies the rest.

Answer 2

There is no foolproof way to respond only to requests made by your app.

User agent sniffing, navigator feature detection, and like measures may deter most basic attempts to load information from that url (like search engine bots), but anyone with a little time can learn to replicate the HTTP requests made by your app, defeating those measures.

Even requiring a login will not prevent external request (they can send requests matching your login workflow to obtain a valid token, then request the restricted url with it).

Answer 3

(via the comments) I just don't want to overload the server with unnecessary requests.

In that case, there's a much better solution. Laravel ships with a throttle middleware, which you can use to limit the number of requests per minute per IP (or per logged-in user, if they're authenticated).

Just add throttle:60,1 to your route's middleware and it'll max out at 60 requests per minute for a particular IP address. Set it to something relatively high (so normal use doesn't hit it), but it'll prevent millions of requests from the same IP from using up too many resources.