If you designed the protocol between your app and the server yourself, how would you let the server notice that the contents changed in transit? Assume you already use HTTPS.
Canonicalize the request body and the main headers, sign them with an HMAC (or a device private key), and send the signature in a header. The server recomputes it the same way and rejects a mismatch as tampering. HTTPS stops a man in the middle on the path but not the endpoints, a proxy or a modified app, and the signature covers that gap.
SecurityShort answerIntro
Why does an iOS app have to be code signed before it runs? Focus on what the signature…
#integrity
SecurityShort answerAdvanced
Your app puts the token the server returned at login into the header of every request. An…
#replay
NetworkingShort answerAdvanced
You're downloading an audio file of several hundred MB, and the app gets terminated or…
#integrity