Secure PHP REST API

Question

I am making a Social Networking website and I want to provide APIs for developers to use. So, I am thinking of using REST API for this.

Now this question is not about how to create a REST API. That is well explained in many websites and SO questions.

My Question is: When I give a developer this API (lets say which can be used to get user info).

Say USER 1 does not want his date of birth and email to be visible

Say USER 2 does not want his mobile number to be visible

Say USER 3 does not want anyone apart from his friends to see his info

... and so on (each user have their own privacy setting which I have already stored in DB)

Now, how do I authenticate properly to make sure:

1) Developers will not be able to access User info when they have not authenticated the Application to use API to access their info

2) Restrict Developers from accessing fields which has been set by the user as private

Do I have to make separate DBs for this? Is there any easy, professional and secure way to do this?

Answer 1

If you look at the documentation for the various Google+ and FB API's, you'll see what they do. Here's an example:

https://developers.facebook.com/docs/marketing-api/authentication

Generally, you use https to connect, you supply a couple of different key codes (api key, etc.) to an authentication call of some sort, and you get back a session token, which you pass to all subsequent calls that require one (which potentially involve non-public data).

There isn't anything all that special about the authentication that is typically used for this kind of thing, any secure authentication method works as well as any other. All authentication does is establish the identity of the API caller and/or the identity of a user. It is then up to the API code to determine who can access what.

You could have a small group of trusted developers develop the API in a development environment, and then an even smaller group of trusted administrators deploy that API to production servers, and make sure no one else can access those servers except through the API. I believe that's essentially what FB and Twitter and so forth do.

But if you really want to prevent the developers who develop the API and the administrators who set up and maintain your production servers (and databases) from being able to get at user's private data, that data will have to be encrypted on the users' computers, before it is ever sent to the server, using keys that are never sent to the server. So neither the server nor anyone in the server environment will have any way at all to decrypt that data.

But the developers who develop the encryption program that runs on users' computers could make it send keys or decrypted versions of data to a computer somewhere, etc., so there isn't really any way to avoid having to trust at least some of the people involved.

By the way, Google+, Twitter, Facebook, etc., don't do that. They may store some private data in an encrypted form in their production databases, and they may restrict access to those databases to a small group of people, and even those people who have access to the databases may not be able to see the private information without decrypting it - but the data is sent to the servers using https; it is encrypted by a user's browser, but then decrypted on the web server, and it exists in an unencrypted form in the memory of the web server, at least for a short time, so it would certainly be theoretically possible for people at those companies who have the right expertise and the right access to get at users' private data. So our private data on Twitter / FB etc, isn't really 100% secure. (I doubt that any data anywhere is really 100% secure.)

While there are common practices that you can glean from reading their API docs, there aren't really any established standards or best practices that specifically relate to how to code authentication systems for social media APIs in PHP.

It's worth mentioning that many web sites that require user authentication, these days, allow users to authenticate using various external authentication systems, so that once they are signed into one place that uses that system, they're effectively signed into every place that uses it. One really popular external authentication system is GoogleID; for example, users of Stack Overflow can authenticate using their Google logins:

https://developers.google.com/identity/

https://developers.google.com/identity/choose-auth

GoogleID may have been inspired by OpenID. Here is a list of libraries for implementing an API that facilitates OpenID style authentication:

http://openid.net/developers/libraries/

That page includes a couple of php libraries which may be of interest.

By the way, speaking of data security in the context of a social media site, here's an introductory wiki page about the general legal requirements, in the US, for companies that process (potentially) personally identifying information:

https://termsfeed.com/blog/privacy-policies-are-mandatory-by-law/