secure http calls in ios - iphone

Question

How do I secure http call everytime I fire from my app and also it needs to have timeout so that any other user cannot use the same link from any browser.
I am looking for ios solution in particular and not html form.
Please help me out. Unable to resolve this issue and dont know in which direction to proceed.
Thanks in Advance.
I am attaching Working code for both PHP and ios which posts the Request and gets back the Response but no security is attached and any user can get the same Response by calling the same HTTP Response from Browser anytime...
ios code:
NSURL *url=[NSURL URLWithString:#"http://example.com/getmsgs/strno=123"];
NSURLRequest *request=[NSURLRequest requestWithURL:url];
connection=[NSURLConnection connectionWithRequest:request delegate:self];
if(connection){
webData=[[NSMutableData alloc]init];
}
NSError *requestError = NULL;
NSDictionary *allData=[NSJSONSerialization JSONObjectWithData:webdata options:0 error:&requestError];
if (requestError){
//An error occurred.
NSLog(#"error is : %#",requestError);
}
if (! allData) {
NSLog(#"Got an error: %#", requestError);
} else {
NSLog(#" data is : %#",allData) ;
}
NSArray *arrayOfEntry=[allData objectForKey:#"json"];
for (NSDictionary *diction in arrayOfEntry) {
NSString *label=[title objectForKey:#"image"];
NSString *label2=[title objectForKey:#"artist"];
NSString *label3=[title objectForKey:#"name"];
[array addObject:label];
[array addObject:label2];
[array addObject:label3];
}
php code:
<?php
$strno=$_GET['strno'];
if (isset($strno))
{
$connect=mysql_connect("localhost","test","test") or die ('Connection error!!!');
mysql_select_db("test") or die ('Database error!!!');
$query=mysql_query("select sno FROM users where strno='$strno';");
while($row = mysql_fetch_assoc($query))
{
$jsonoutput='{"json":{
"image":"'.$row['image'].'",
"artist":"'.$row['artist'].'",
"name":"'.$row['name'].'"
}}';
}
}
echo trim($jsonoutput);
mysql_close($connect) or die ('Unable to close connection-error!!!');
}
?>

Answer 1

You could use some kind of session to achieve what you want. For example, when user opens(runs) your ios app, you could connect to your web-service to get the session key (token), which would be unique for the device that app is running. And, when your ios app goes to the background, you could invalidate the token (using ios background execution would be appropriate here). Also, you could use time-limited session keys, meaning for example your session key will expire in 10 mins (which get invalidated on the server side), and for the new web requests your server has to issue another session key. Good Luck!