PHP to do app interface development, interface security

1, when the user login to the app, using the HTTPS protocol to invoke the background related interface, the server based on the user name and password to generate a access_key, and Access_key saved in the session (or saved in Redis), the resulting access_ Key and session_id are returned to the app side.

2, the app side will receive the Access_key and session_id saved up

3. When the app side calls the interface to transmit data, the transmitted data and the Access_key use the encryption algorithm to generate the signature signature, and send signature and session_id together to the server side.

4, the server to receive data, using session_id from the session to obtain the corresponding Access_key, Access_key and received data using the same encryption algorithm to generate corresponding signature, If the generated signature and the received signature are the same, the data is valid

PHP to do app interface development, interface security