I have an iOS Shopping App and want that the customers smartphones send Logs (when a crash happens for example) to an AWS Lambda function.
How can I avoid that other Apps than my own App can send Logs to this Lambda Function? I need some kind of authentification.
Theres a great tutorial on something like this here
Basically you need to go through the process of setting up a Lambda authorizer, which is a multifaceted approach to authorization and can serve any need.
The docs are particularly verbose about this subject.
Related
Can I use Alexa skill from my iOS application (just like we do it from the Echo dot etc)?
I checked a few old links which are working as follows, and I think it can be done using AVS:
record the message
upload it and get Alexa's response
Play it using some player
For that, it needs token (which can be obtained if a user logs in).
I checked a few SO links (link1, link2) as well but didn't get the answer.
Is there any SDK or API to do it? I didn't get enough info from AWS documentation.
Is it even possible? How to use AVS in my iOS app?
I believe you need to explore AWS LEX. It is the same service that powers Alexa. It allows you to create conversational bots, that can consume voice or text input and can give back voice or text output. You can integrate lex in any application whether it is mobile, web or voice application.
Here is a useful link that you can follow to understand how you can utilize LEX for your iOS app.
Deploying an Amazon Lex Bot in Mobile Applications
Hello I have a iOS App and want to send my Logs to a Lambda Function.
I have the ARN Name of the Lambda Function. Where do I have to put this ARN that the Logs getting send to the Lambda?
Many Thanks
Marc
You can use the invoke API in Lambda Invoker to specify the function name. You find the API details here:
https://github.com/aws-amplify/aws-sdk-ios/blob/master/AWSLambda/AWSLambdaInvoker.h#L225
I would imagine you should make your Lambda an API that your app can PUT/POST the logs to.
AWS just released a feature to allow Lambdas to be directly hooked against an ALB (No need for APIGW).
https://aws.amazon.com/blogs/networking-and-content-delivery/lambda-functions-as-targets-for-application-load-balancers/
There is no need for your App to know about AWS at all. It just needs a restful API to send data to.
Another alternative is to use Amazon Pinpoint SDK in your app and post custom events
https://docs.aws.amazon.com/pinpoint/latest/developerguide/integrate-events.html
If I'm creating an IOS React Native app, where is the best place to store client secrets for external APIs? I see a lot of tutorials and such that just hard code them, but proceed to say something along the lines of "DON'T DO THIS" without actually providing a valid example of how to actually do it for something production level.
TLDR: All I want to do is secure my cloud function in Parse so that it only accepts requests from my iOS app. How can I do that?
Longer version:
I recently got started with using Parse for a client side app I'm building using a Google API.
Before using Parse, my issue was that the Google API calls from my app were not secure. I tried a Man in the middle attack on my app, and I was able to successfully get the bundle id and app id (Google claims some form of security is achieved by ensuring that the call is from the correct bundle id that you can specify on their console). So despite using SSL, seems like it was easy to get this information. Now this Google API is paid, so someone could easily abuse my key when I release my app and raise my bills.
I was anyways also thinking of doing some lightweight work in the backend, so I figured to use Parse. Now the call to the Google API is done in Cloud Code. But a new problem I'm facing is how to secure calls to the Cloud function I've defined in Parse? The Parse App ID and Client Key aren't secure at all.
All of Parse's blogs keep talking about creating users and defining ACLs etc. But in my case, there is no data in my Parse app and there is no user per se. It simply calls the Google API and returns the result. All I want to do is secure my cloud function so that it only accepts requests from my iOS app. How can I do that?
The inherent security risk here is that any key you store in your app is vulnerable, for that reason encryption is also vulnerable. My recommendation is to use the automatic user in Parse on your iOS app, you could even throttle excessive requests/abuse by a single user. By creating and using a user you are able to gain the benefits of ACL which appears the best security option available in Parse currently. At that point you send the automatic user in your cloud code request and verify it's a valid iOS user.
I am implementing Stripe Payments in my iOS app and i obviously cant store credit card information over the iOS app so i have to create tokens and send that to the server to be charged etc.
My question is how can i communicate iOS => server and vice versa
My web app is in Rails by the way.
I read in some places that i might need to create a API on my server? then call it from my iOS side?
if anyone has an idea on how to do such a thing please let me know, i would appreciate it a lot.
Yes, you must create (or update) your Rails application to expose an HTTP API, which usually communicates using JSON. Your API will need to respond to POST/GET/whatever requests the iOS app make and behave correctly based on what you expect to do (do something with some tokens from my understanding).
Please notice though that handling payments and not having already the knowledge on how to do such a thing might be dangerous for the end user.
To give you a general overview of the process:
Create Rails routes, controllers, models required to manage the logic of perform a payment from a token, this is entirely your job unless the Rails app you are working with, already support this
Update your iOS app to send, probably with a POST request, the token you talked about, you'll probably need to define some sort of authentication protocol, look into JWT or something similar, you won't have cookies at your disposal in the iOS app
It's a long but interesting task