I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify or delete them. Not Ideal...
I have the option of restricting certain activities to authenticated users only. However, I think that means anyone with a facebook account can log in and have the same privileges as above? Also, I would rather not require users to log in.
I only want users to be able to access their own records (data privacy) and I want to ensure that only my application can POST data to the server, i.e. an unofficial potentially corrupted app shouldn't be able to POST data and corrupt my database. Maybe some sort of TLS etc. approach might do this? This restriction (if possible) would likely allow me to implement the above logic in the mobile software logic?
What are some common approaches to these issues and how might I approach them specifically with Azure Mobile Services. Specific approach recommendations and Azure feature references would be ideal.