Here's the scenario...
I have a web site that has a generic handler written in asp.net (.ashx file) that accepts http requests, gets relevant data, converts the result into xml and then passes that back via the response.
This will eventually be used so that a windows application can make data requests to this web site.
My concern is that anyone who knows how to put together the request can then access potentially personal data. The data isn't anything as sensitive as financial information, but it will have names and addresses so I obviously need to think about securing it.
My initial thought was to encrypt the information before responding, and maybe even encrypt the request as well, and I'm happy to do this, but I just wanted to ask some other boffins for their opinion on the matter.
Is this something that has a "standard" way of doing it, or is it simply a case of thinking of something suitable and implementing it.
Incidentally, the windows app will be distributed all over the country so the requests will come from many places. Using the IP address is not only a laborious way of doing it, but it also doesn't help as you could obviously send the message from an IP without using the application.
How do I make sure that it was my windows app that asked my web app for information?