What is the best way to secure a RESTful API to be accessed on an iPhone.

Answer 1

I would think that, if the application contains medical records, you would want to have the user authenticate every time they use the application or, at least, have some way of pushing down a disable message that renders the app useless in the case where it is lost or stolen. The 4-6 character password (pin) would also concern me with respect to HIPAA, if it applies.

You might want to treat it as a standard web app from the server perspective and do session-based authentication and access with a session that times out, perhaps after a long period, and re-authentication on timeout.

Answer 2

You could use SSL with client authentication. If a device gets lost, you can remove the certificate on the server. There are some obstacles though:

• It is not entirely clear if/how you can do client authenticated SSL on the iPhone Unfortunately, there is not much documentation about it. Have a look at Certificate, Key, and Trust Services Reference
• You have to create a private key for every device
• You also have to figure out a secure way to transfer the private key to the device