如何防止除iPhone应用程序之外的其他任何东西与Rails Web应用程序通信？

Question

I'm diving into web development and I've built a few basic rails apps, but now I'd like to begin learning how to securely connect my iOS apps with my Rails apps. 我正在研究Web开发，并且已经构建了一些基本的Rails应用程序，但是现在我想开始学习如何将iOS应用程序与Rails应用程序安全地连接起来。 For example, if I want my iOS app to query my Rails webapp for some data from the DB by passing parameters in the url... 例如，如果我想让我的iOS应用通过在url中传递参数来查询我的Rails Web应用以获取数据库中的某些数据...

http://mywebapp/mycontroller/search?q=keyword

...what are some common web development methods I can use to prevent anything (or anyone) other than my iOS app from successfully executing that search query? ...我可以使用哪些常见的Web开发方法来阻止除我的iOS应用以外的任何（或其他任何人）成功执行该搜索查询？

I'm sure this type of forgery that I'm trying to prevent has a formal name, but I'm very new to web development and I'm still learning all the jargon. 我确定我要防止的这种伪造具有正式名称，但是我对Web开发非常陌生，我仍然在学习所有术语。 Thanks so much for your wisdom! 非常感谢您的智慧！

Answer 1

Use the trick that Rails uses in the protect_from_forgery by generating a unique key for you iphone app. 通过为您的iPhone应用程序生成唯一密钥，使用Rails在protect_from_forgery使用的技巧。 Then ensure that your app passes that key in the requests to the server. 然后，确保您的应用将请求中的密钥传递给服务器。 You can then write a before_filter to ensure that the request possesses the key. 然后，您可以编写一个before_filter来确保请求拥有密钥。 If it does then you process the request. 如果是这样，则您将处理请求。 If it does not then you return an error with a custom message explaining why they can't have access. 如果不是，那么您将返回一条错误消息，并显示一条自定义消息，说明他们为何无法访问。

Answer 2

You could create a hash and use it as a token which would be passed with each call to identify your application (hard coded value in the app) and the session (current ip address of the client.) So: hard_coded_value + ip_addressed -> MD5/SHA1 (whichever) = token. 您可以创建一个哈希并将其用作令牌，该令牌将随每次调用一起传递，以标识您的应用程序（应用程序中的硬编码值）和会话（客户端的当前IP地址。）因此：hard_coded_value + ip_addressed-> MD5 / SHA1（以任何一个为准）=令牌。 Your server would also have a copy of the hard coded value as well as the calling client's ip address, perform the same hashing function and compare the results. 您的服务器还将具有硬编码值的副本以及主叫客户端的IP地址，执行相同的哈希函数并比较结果。 If they match, it's your app. 如果它们匹配，那就是您的应用。 If not, then it isn't. 如果不是，则不是。