Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent disallowed application to access the service?For instance, I have a web service which is called by my iOS application. I want to prevent others from calling my web service.Regarding the fact that others can decompile my client application and create another one which is working the same as mine, I think the only way to avoid unwanted access to the service is to check application identity on server to ensure the request comes from my own application.Is there any robust and secure way to do that?
Is it possible to check a client side application identity from server side?
security;app;identity
No. As you said, anyone can decompile and mimic your own client application. You can never trust input from a client if you do not trust the user of the client.You can add additional safeguards to attempt to make it more difficult to create a new client. For example, if your client always uses services with a certain max frequency, then a client that connects and issues requests much faster than that may be a hacked client.