title: iPhone App with a Server Backend - How to ensure all access is from the iPhone app only?
body: <p>I don't mind so much about pirating etcetera, but I want to ensure that the backend (Rails based) isn't open to automated services that could DOS it etc. Therefore I'd like to simply ensure that all access to the backend (which will be a few REST queries to GET and PUT data) will be via a valid iPhone application, and not some script running on a machine.</p>
  
  <p>I want to avoid the use of accounts so that the user experience is seamless.</p>
  
  <p>My first intention is to hash the UDID and a secret together, and provide that (and the UDID) over a HTTPS connection to the server. This will either allow an authenticated session to be created or return an error.</p>
  
  <p>If eavesdropped, then an attacker could take the hash and replay it, leaving this scheme open to replay attacks. However shouldn't the HTTPS connection protect me against eavesdropping?</p>
  
  <p>Thanks!</p>