[SOLVED] How to protect JSON API from being accessed by anyone but my iOS client?

How to protect JSON API from being accessed by anyone but my iOS client?

I have an iPhone app that uses a Rails server HTTP API. The API is public at this point - no authorisation is required to get the data.

Currently anyone can go to API's URL and download the data.

http://server.com/mydata

The data is not very sensitive. But I still want to prevent people from easily getting it. What are the ways of doing that? I do not want iOS app users to log in either.

Current solution I have

iPhone app adds a secret token to the HTTP header or query of the request. The data goes over HTTPS.

https://server.com/mydata?secret=my_secret

Is there a better approach?

Solution

You could try an approach where the client is only allowed X number of requests per time period (based on IP address or username)

HTTPS is extremely easy to man in the middle on a device you control. You can do SSL cert validation, but there is always someone out there with more time, so best off to handle it server side.