I am exposing a few REST methods on a server for an mobile app.
I would like to avoid that users can sniff how HTTP methods are built (from the mobile app) and then send them again to the server. Example :
- The mobile app send a request
- The user uses a proxy and can check what's going on on the network
- The user sees and save the request that the mobile just sent
- => Now I don't want the user to be able to send over manually that request
Is it enough to secure the server over HTTPS?