title: How to protect the 'public' part of a REST service from spam?
body: <p>I have a REST service that's reasonably complete and will be used with an iOS app. It's built using Ruby/Sinatra but I don't think that really matters here.</p>
  
  <p>I'm using HTTP Basic Authentication over SSL for various endpoints and that part is working very well.</p>
  
  <p>Question is:
  How do I stop spammers etc from calling parts of the REST service that aren't protected via HTTP Basic Authentication?</p>
  
  <p>Example: <strong>User Registration</strong></p>
  
  <p>Let's assume the REST call is <em>(POST)</em> <strong>.../register_account</strong> passing a JSON object in the body.</p>
  
  <p>For obvious reasons, this call cannot expect a username/password linked to a user account.</p>
  
  <p>Ideas are:</p>
  
  <p>1) The app has its own 'username' / password and some calls would check for app-credentials.
  Problem: Rooting the device etc could unearth those credentials.</p>
  
  <p>2) The app passes a secret token via a HTTP header to the REST Service for those calls.
  Problem: Same as (1)</p>
  
  <p>Are there any techniques commonly used out there to prevent such spam calls? I'm thinking maybe introduce the iPhone's device id in the mix but haven't identified a definite approach yet.</p>
  
  <p>Thanks</p>