title: Mobile App Web Service Security
body: <p>I am building an android app which consumes a soap web service that I have hosted on my server. I will have client apps for other mobile OS also in the near future. There are a few concerns with the web service security which I have posted below.</p>
  
  <ul>
  <li><p>How to secure the username/password used for wsse authentication on the mobile device app ? I do not want to use something specific to android as I may have apps out for iPhone/Blackberry in the near future</p></li>
  <li><p>If someone de-compiles the apk file and get the wsdl url, how to prevent the DOS - denial of service attacks ?</p></li>
  <li><p>is HTPPS really worth it ? if a hacker gets the wsdl url from the app, he can trigger faulty requests which can end up in DOS.</p></li>
  <li><p>Does using oAuth with REST have an advantage over SOAP with wsse ?</p></li>
  </ul>
  
  <p>I feel that if the hacker ultimately gets the wsdl url, he can trigger hundreds of faulty unauthenticated requests itself which can overload my server.Please help me in figuring out the best solution for my scenario.</p>