title: Restrict access to web service to only allow mobile clients
body: <p>I'm currently building a mobile application (iOS at first), which needs a backend web service to communicate with. </p>
  
  <p>Since this service will be exposing data that I only want to be accessed by my mobile clients, I would like to restrict the access to the service. </p>
  
  <p>However I'm in a bit of a doubt as to how this should be implemented. Since my app doesn't require authentication, I can't just authenticate against the service with these credentials. Somehow I need to be able to identify if the request is coming from a trusted client (i.e. my app), and this of course leads to the thought that one could just use certificates. But couldn't this certificate just be extracted from the app and hence misused?</p>
  
  <p>Currently my app is based on iOS, but later on android and WP will come as well. </p>
  
  <p>The web service I'm expecting to develop in nodejs, though this is not a final decision - it will however be a RESTful service. </p>
  
  <p>Any advice on best practice is appreciated!</p>