iPhone: How do I securely transfer data from device to server - iphone

Question

could someone please assist me, Im a newbie and haven't done this before.
I have an iPhone app which has a "cart" object. Once the user has made his selections, I want to send that info in an XML file to the server. I read that the iPhone libraries let you convert data into XML easily. But from what I understand the data has to be stored in an array or a dictionary. Is this true? For example, my "Cart" is an object that uses a array to store data internally but the "cart" itself has variables which are not stored in an array or dictionary.
Q) How can I convert the entire "cart" into something that can be transported as XML to my server?
Also, I am asking the customers to create a profile for each order but this will be done by Launching UIWebview directly on the web through an https connection. So no credit card info will be on the device.
Q) Whats the best way to link the profile on the web and the order which is on the device?
Could someone who has come across this issue please give me tips or links?
Thanks

Answer 1

Sending your data securely could be done with ssl.
Converting your cart to XML could be done with an XML Framework/lib, still you'll have to write the code for that. For example touchXML:
TouchXML is a lightweight replacement
for Cocoa's NSXML* cluster of classes.
It is based on the commonly available
Open Source libxml2 library.
Here is a nice tutorial.
Source has moved a bit, can be found here
To your second question: This is tricky and may get hacky. However if you don't want to switch to an API based way to login/create the account I'll have these ideas.
Check the "result" of webView with the UIWebViewDelegate protocol with the webViewDidFinishLoad: method. A "result" may be: successful creation of an account or successful login.
So you can access the body of the page with the NSURLRequest property of the webview. Or use something like this, using javascript:
NSString *html = [webView stringByEvaluatingJavaScriptFromString: #"document.body.innerHTML"];
You will have to do parsing though to look for something, for example a token which you can connect with the order for final checkout.
You also could have generated a unique order string on the device in the first place and sent it over initially for login/creation of profile to increase security a bit and pass it back for a check.

Answer 2

Part one: create a dictionary that represents the cart. For each variable, add a key with its variable name as the key, and the cart object's value for that variable as the object for that key.
Part two: that's a very open-ended question :-). That depends on how you identify the user at both ends; though of course that will depend on your security requirements. One option is to require your user logs in via the web site when they first launch the device, then store their user ID on the app on a particular device (preferably in a confidential fashion). Don't use that for any reason other than to track which user you think is at the device: authenticate again before each purchase, or other sensitive actions like viewing or changing account details. By the way depending on the way your ordering system works, you may prefer (or be required by Apple) to implement in-app purchase. That would actually take a lot of the complexity away from the problem, at the cost of Apple's 30% processing fee.
If you have specific questions about the security concerns of such a system, you would do well asking at security.stackexchange.com (I'm one of the pro tem moderators over there).

Answer 3

If you send an encrypted string to a URL like in the code below, then handle it in an ASPX page (.NET example) or you can use other languages on the server side. Then, for security, simply ignore anything that doesn't decrypt (basic encryption-decryption not shown)
NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:[NSURL
URLWithString:#"http://myzuresite.azurewebsites.net/test3.aspx?bigstring=dgrbthymgk"]];
[request setHTTPMethod:#"POST"];
[NSURLConnection connectionWithRequest:request delegate:self];}
Then, in the http://myazuresite.azurewebsites.net/test3.aspx page:
<%# Page Language="C#"%>
<html>
<head>
<title>Query Strings in ASP.NET: Page 2</title>
<script language="C#" runat="server">
</script>
</head>
<body>
<%
// retrieves query string values
string bigstring = Page.Request.QueryString["bigstring"];
System.Data.SqlClient.SqlConnection sqlConnection1 =
new System.Data.SqlClient.SqlConnection("Data Source=myazuresite.database.windows.net;Initial Catalog=db_name;Integrated Security=False;Persist Security info=False;User ID=your_id;Password=your_Password”);
System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand();
cmd.CommandType = System.Data.CommandType.Text;
cmd.CommandText = "INSERT Scores (col1) VALUES (' "+name+" ')";
cmd.Connection = sqlConnection1;
sqlConnection1.Open();
cmd.ExecuteNonQuery();
sqlConnection1.Close();
%>
</body>
</html>
I handle the decryption in an insert trigger in SQL Server, ignore bad URL's, and this is VERY secure. I use encryption that includes time in some way.