authentication - How to achieve client validation in iOS? -

how verify if api being hit actual application , not going through mitm attacks.

i understand ssl certificates can used achieve transport level security , app can sure taking correct server, how can attain same thing app side.

i want make sure app hitting services , hit not coming somewhere don't trust.

thanks

have @ ssl again - offers client certificates, example, so. yet, shifts problem attacker might use same mechanism apps use certificates. (an shared api token considered okay , easier implement.)

in general, cannot achieve guarantee that. might result issueing certificates based on user authentication external means (e.g. make users put in user names , passwords) or make hard adversaries abuse api using reverse turing tests (e.g. automated programms tell computers , humans apart, aka captchas).