PHP Development API Interface Security Verification

API Interface for PHP

In the actual work, the use of PHP to write API interface is often done, PHP written interface, the front desk can be linked to get the data provided by the interface, and the returned data is generally divided into two cases, XML and JSON, in this process, the server does not know, the source of the request is what, It's possible that someone else illegally calls our interface to get the data, so we need to use security authentication.

Verification Principle

Principle

It can be seen clearly that the foreground wants to invoke the interface and needs to use several parameters to generate the signature.

• Timestamp: Current Time
• Random numbers: Randomly generated random numbers
• Password: Before the background development, a mutual know the identity, equivalent to the password
• Algorithm rules: Agreed good operation rules, the above three parameters can be used to generate a signature algorithm rules.

The foreground generates a signature that, when required to access the interface, passes the timestamp, random number, and the signature through the URL to the background. The background gets the timestamp, after the random number, computes the signature by the same algorithm rule, then compares with the signature which passes over, the same words, returns the data.

Algorithm rules

In front of the background interaction, the algorithm rules are very important, the front and back of the table through the algorithm rules to calculate the signature, as to how the rules are formulated, see how happy you come.

My algorithm rule is

1. timestamp, random number, password sorted in first letter case
2. Then stitch into a string
3. For SHA1 encryption
4. Re-MD5 Encryption
5. Convert to uppercase.

Front desk

I don't have a real front desk here, just use a PHP file instead of the foreground, and then simulate get requests via curl. I am using the TP framework, the URL format is pathinfo format.

Source

<?Php/** * Created by Phpstorm. * User:tank * DATE:2018/5/6 * time:15:56*/namespace Client\controller;UseThink\controller;Class ClientcontrollerExtendscontroller{Const TOKEN = ' API ';//Simulating the foreground Request Server API interfacePublicfunctionGetdatafromserver () {//Time stamp$timeStamp =Time();//Random number$RANDOMSTR =$thisCreatenoncestr ();//Generate signature$signature =Arithmetic, $this ($timeStamp,$randomStr);//URL address$url = "http://www.apitest.com/server/server/respond/t/{$timeStamp}/r/{$randomStr}/s/{$signature} ";$result =HttpGet, $this ($url); Dump$result); }//Curl simulates a GET request.Privatefunction HttpGet ($url){$curl =Curl_init ();//Which address is required to request curl_setopt ($curl, Curlopt_url,$url);//Indicates the output of the requested data to a variable in the way it was streamed curl_setopt ($curl, curlopt_returntransfer,1);$result = Curl_exec ($curl); Curl_close ($curl);Return$result; }//Randomly generated stringPrivatefunction Createnoncestr ($length = 8) {$chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";$str = "";for ($i = 0;$i <$length;$i + +) {$str. =Substr$chars,Mt_rand (0,Strlen$chars)-1), 1); }Return "Z".$str; }/** * @param $timeStamp timestamp * @param $randomStr random String * @return string return signature*/Privatefunction Arithmetic ($timeStamp,$randomStr){$arr [' timeStamp '] =$timeStamp;$arr [' randomstr '] =$randomStr;$arr [' token '] = self::TOKEN;//Sort alphabetically by first letter of caseSort$arr,sort_string);//Stitching into strings $str = implode ( $arr // encrypt  $signature = SHA1 ( $str  $signature = md5 ( $signature ); // convert to uppercase  $signature = strtoupper ( $signature return  $signature ;}    

Server-side

Accept foreground data for verification

Source

<?Php/** * Created by Phpstorm. * User:tank * DATE:2018/5/6 * time:16:01*/namespace Server\controller;UseThink\controller;Class ServercontrollerExtendscontroller{Const TOKEN = ' API ';//Responding to requests from the front deskPublicfunctionRespond () {//Verifying identities$timeStamp =$_get[' t '];$RANDOMSTR =$_get[' R '];$signature =$_get[' s '];$str =Arithmetic, $this ($timeStamp,$randomStr);If$str! =$signature){echo "-1";Exit; }//Analog data$arr [' name '] = ' API ';$arr [' age '] = 15;$arr [' address '] = ' zz ';$arr [' IP '] = "192.168.0.1";Echo Json_encode ($arr); }/** * @param $timeStamp timestamp * @param $randomStr random String * @return string return signature*/Publicfunction Arithmetic ($timeStamp,$randomStr){$arr [' timeStamp '] =$timeStamp;$arr [' randomstr '] =$randomStr;$arr [' token '] = self::TOKEN;//Sort alphabetically by first letter of caseSort$arr,sort_string);//Stitching into strings $str = implode ( $arr // encrypt  $signature = SHA1 ( $str  $signature = md5 ( $signature ); // convert to uppercase  $signature = strtoupper ( $signature return  $signature ;}    

Results

String ("{") "{" "Name": "API", "Age": "Address": "ZZ", "IP": "192.168.0.1"} "

PHP Development API Interface Security Verification