How can I validate data uploaded directly to S3?

Question

I have an iPhone application that uploads images directly to S3. Then it hits an endpoint on my web server and creates a new post with some metadata, along with the S3 URL for the uploaded image. All of this occurs over SSL, but what is stopping someone from reverse engineering the endpoint for creating posts and supplying a bogus URL?

Answer 1

No, it is not possible to really ensure that only your app can contact your server, but you can provide some kind of signature to your app, which is posted to your server via HTTPS before the real communication takes place.

Taking a look at API authentication in general is a good idea I think. This looks like a goot start: Principles for Standardized REST Authentication