CODEWITHSUNDEEP
phpmysqlapi
bobthemac
bobthemac

Reputation: 1172

Create secure API communication

I am looking to build an API that I can deploy on my servers to monitor system load.
It will report to a central manager server that runs a client to display the information.

The issue I am struggling with is best to secure the API.
What I want is for the client to be the only software that can access the server and retrieve this information but I am unsure how to achieve this using PHP.
I also want the possibility of distributing the API and client for others to use on their servers so I don't want people to be able to access other people data if they are using the API also.

The client is also written in PHP using MySql and has a secure login.

Upvotes: 1

Views: 322

Answers (2)

Pekka
Pekka

Reputation: 449415

This sounds like you're trying to solve the wrong problem.

I also want the possibility of distributing the API and client for others to use on their servers so I don't want people to be able to access other people data if they are using the API also.

The only right answer to this is authentication. You need to protect your API by giving each user access credentials known only to them.

Your API must never reveal any data that the client isn't allowed to see as per their authentication credentials. Trying to work around this danger by trying to somehow protect the client from prying eyes is not safe - somebody who has access to the client and can observe it running will be able to reverse engineer any traffic between it and the server given enough effort.

If the API is properly secured, it won't matter to you which client tool is used to access it. The requirement to limit API access to a certain program will go away.

Upvotes: 1

tony gil
tony gil

Reputation: 9554

if you use SSL, along with authentication (i use 3rd party auth google, fb, etc), create data /reports on the fly and have the data saved in a subdirectory OUTSIDE your web folder (instead of /var/www, /var/myStorage/currentSessionId/), then you basically guarantee the security that you want.

your php will only access a subdir that is named for the session it is running under.

Upvotes: 0

Related Questions