ios - 我如何保证对我的服务器的请求是由我的 iOS 应用程序在真实设备上生成的？

Question

我想从我的 iOS 应用向我的服务器发送一条小消息。

但是，我希望高度确信数据实际上是:(1) 在设备上生成的，以及 (2) 由我的应用程序生成的。

有什么办法可以实现吗？我更关心 (1) 而不是 (2)。

Roku 很早就有这样的功能:http://sdkdocs.roku.com/display/sdkdoc/Channel+Packaging+And+Publishing#ChannelPackagingAndPublishing-37ContentSecurityModel

Each Roku box has a unique client certificate that is signed by Roku as the Certificate Authority. The firmware also supports a special header, x-roku-reserved-dev-id, that always sends the developer id of the currently running application. Since this is authoritative and can't be forged, the developer's web server can only accept connections from a Roku Streaming Player running their application. Likewise, the Roku Streaming Player can enforce that it is talking to the developer's web server by including the CA certificate of the authority that issued their web server certificate in their channel application.

Answer 1

通常您会在提出请求时添加此类信息。您可以添加额外的 header 来指定有关您的设备、应用程序、版本等任何信息。

示例:

NSURLRequest *request = [NSURLRequest requestWithURL:[NSURL URLWithString:@"http://www.example.com"]];
[request addValue:@"iOS" forHTTPHeaderField:@"X-platform-name"];
[request addValue:@"ApplicationName" forHTTPHeaderField:@"X-application-name"];

更好

[request addValue:[UIDevice currentDevice].model forHTTPHeaderField:@"X-platform-name"];

---

或

您也可以使用 Javascript 检查它

var iOS = false;
var p = navigator.platform;

if( p === 'iPad' || p === 'iPhone' || p === 'iPod' ){
    iOS = true;
}