title: Architecture of a secure client-server phonegap app
body: <p>I am thinking about the architecture of a phonegap game app which, as lots of ditributed game app, will act as a client of a server. It will need username-password authentification. I plan to use AJAX to communicate with my server. However, I have a couple of questions concerning security. Here they are:</p>
  
  <ol>
  <li>How can I make sure the request is made from my game and not by anyone else ? For example, how to avoid that somebody can send a POST request to the script on the server called by my game ?</li>
  <li>How can I secure data transfer ? Is data transfer using a https (SSL) url sufficient ?</li>
  <li>What is the best idea to implement user authentication ? Generate a token to use in communication ? Something else ?</li>
  </ol>
  
  <p>Thank you !</p>