Detailed explanation of security verification steps for PHP development api interface

This time I will bring you a detailed explanation of the security verification steps for the PHP development api interface. What are the precautions for security verification of the PHP development api interface? The following is a practical case, let's take a look.

php’s api interface

In actual work, it is common to use PHP to write api interfaces. After writing the interface in PHP, the front desk You can obtain the data provided by the interface through the link, and the returned data is generally divided into two situations, xml and json. In this process, the server does not know the source of the request. It may be that someone else illegally calls our interface. , to obtain data, therefore security verification must be used.

Verification principle

Schematic diagram

Principle

It can be clearly seen from the picture that if the front desk wants to call the interface, it needs to use several parameters to generate a signature.

Time stamp: Current time

Random number: Randomly generated random number

Password: During front-end and back-end development, an identifier known to both parties , which is equivalent to the secret code

Algorithm rules: The agreed operation rules, the above three parameters can use the algorithm rules to generate a signature.

The frontend generates a signature. When accessing the interface is required, the timestamp, random number, and signature are passed to the backend through the URL. After getting the timestamp and random number in the background, it calculates the signature through the same algorithm rules, and then compares it with the passed signature. If it is the same, the data is returned.

Algorithm Rules

In front-end and back-end interactions, algorithm rules are very important. Both front-end and back-end must calculate signatures through algorithm rules. As for how to set the rules, it depends on how you like it.

My algorithm rules are

1 The timestamp, random number, and password are sorted in case order of the first letter

2 and then spliced ​​into a

string

3 Perform sha1 encryption

4 Then perform MD5 encryption

5 Convert to uppercase.

Front desk

I don’t have an actual front desk here. I directly use a PHP file instead of the front desk, and then simulate a GET request through CURL. I am using the TP framework and the URL format is pathinfo format.

Source code

<?php
/**
 * Created by PhpStorm.
 * User: Administrator
 * Date: 2017/3/16 0016
 * Time: 15:56
 */
namespace Client\Controller;
use Think\Controller;
class ClientController extends Controller{
 const TOKEN = &#39;API&#39;;
 //模拟前台请求服务器api接口
 public function getDataFromServer(){
  //时间戳
  $timeStamp = time();
  //随机数
  $randomStr = $this -> createNonceStr();
  //生成签名
  $signature = $this -> arithmetic($timeStamp,$randomStr);
  //url地址
  $url = "http://www.apitest.com/Server/Server/respond/t/{$timeStamp}/r/{$randomStr}/s/{$signature}";
  $result = $this -> httpGet($url);
  dump($result);
 }
 //curl模拟get请求。
 private function httpGet($url){
  $curl = curl_init();
  //需要请求的是哪个地址
  curl_setopt($curl,CURLOPT_URL,$url);
  //表示把请求的数据已文件流的方式输出到变量中
  curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
  $result = curl_exec($curl);
  curl_close($curl);
  return $result;
 }
 //随机生成字符串
 private function createNonceStr($length = 8) {
  $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
  $str = "";
  for ($i = 0; $i < $length; $i++) {
   $str .= substr($chars, mt_rand(0, strlen($chars) - 1), 1);
  }
  return "z".$str;
 }
 /**
  * @param $timeStamp 时间戳
  * @param $randomStr 随机字符串
  * @return string 返回签名
  */
 private function arithmetic($timeStamp,$randomStr){
  $arr[&#39;timeStamp&#39;] = $timeStamp;
  $arr[&#39;randomStr&#39;] = $randomStr;
  $arr[&#39;token&#39;] = self::TOKEN;
  //按照首字母大小写顺序排序
  sort($arr,SORT_STRING);
  //拼接成字符串
  $str = implode($arr);
  //进行加密
  $signature = sha1($str);
  $signature = md5($signature);
  //转换成大写
  $signature = strtoupper($signature);
  return $signature;
 }
}

Server side

Accept foreground data for verification

Source code

<?php
/**
 * Created by PhpStorm.
 * User: Administrator
 * Date: 2017/3/16 0016
 * Time: 16:01
 */
namespace Server\Controller;
use Think\Controller;
class ServerController extends Controller{
 const TOKEN = &#39;API&#39;;
 //响应前台的请求
 public function respond(){
  //验证身份
  $timeStamp = $_GET[&#39;t&#39;];
  $randomStr = $_GET[&#39;r&#39;];
  $signature = $_GET[&#39;s&#39;];
  $str = $this -> arithmetic($timeStamp,$randomStr);
  if($str != $signature){
   echo "-1";
   exit;
  }
  //模拟数据
  $arr[&#39;name&#39;] = &#39;api&#39;;
  $arr[&#39;age&#39;] = 15;
  $arr[&#39;address&#39;] = &#39;zz&#39;;
  $arr[&#39;ip&#39;] = "192.168.0.1";
  echo json_encode($arr);
 }
 /**
  * @param $timeStamp 时间戳
  * @param $randomStr 随机字符串
  * @return string 返回签名
  */
 public function arithmetic($timeStamp,$randomStr){
  $arr[&#39;timeStamp&#39;] = $timeStamp;
  $arr[&#39;randomStr&#39;] = $randomStr;
  $arr[&#39;token&#39;] = self::TOKEN;
  //按照首字母大小写顺序排序
  sort($arr,SORT_STRING);
  //拼接成字符串
  $str = implode($arr);
  //进行加密
  $signature = sha1($str);
  $signature = md5($signature);
  //转换成大写
  $signature = strtoupper($signature);
  return $signature;
 }
}

Result

string(57) "{"name":"api","age":15,"address":"zz","ip":"192.168.0.1"}"

I believe you have mastered the method after reading the case in this article, more Please pay attention to other related articles on the php Chinese website!

Recommended reading:

Detailed explanation of the steps for PHP to send JSON format string based on CURL

ThinkPHP framework user information query update and Detailed explanation of deletion steps

The above is the detailed content of Detailed explanation of security verification steps for PHP development api interface. For more information, please follow other related articles on the PHP Chinese website!