What to do if php api security verification fails

Solution to php api security verification failure: 1. Use a PHP file to replace the frontend; 2. Simulate GET request through CURL; 3. Accept the frontend data for verification.

#The operating environment of this article: Windows7 system, PHP7.1, Dell G3.

What should I do if the php api security verification fails?

php’s api interface

In actual work , it is common to use PHP to write API interfaces. After PHP writes the interface, the front desk can obtain the data provided by the interface through the link, and the returned data is generally divided into two situations, xml and json. In this process, the server does not I don’t know what the source of the request is. It may be that someone else illegally calls our interface to obtain data, so security verification is required.

Verification principle

Schematic diagram

##Principle

It can be clearly seen from the picture that if the front desk wants to call the interface, it needs to use several parameters to generate a signature.

Time stamp: current time
• Random number: randomly generated random number
• Password: During front-end and back-end development, an identifier known to both parties, equivalent to Password
• Algorithm rules: Agreed operation rules, the above three parameters can use the algorithm rules to generate a signature.

The frontend generates a signature. When accessing the interface is required, the timestamp, random number, and signature are passed to the backend through the URL. After getting the timestamp and random number in the background, it calculates the signature through the same algorithm rules, and then compares it with the passed signature. If it is the same, the data is returned.

Algorithm rules

In the front-end and back-end interactions, algorithm rules are very important. Both front-end and back-end must calculate signatures through algorithm rules. As for how to formulate the rules, see Come as you please.

My algorithm rules are

• Time stamp, random number, password are sorted in case order of the first letter

• Then Spliced ​​into a string

• perform sha1 encryption

• and then perform MD5 encryption

• Convert to uppercase .

Front desk

I don’t have an actual front desk here. I directly use a PHP file instead of the front desk, and then simulate a GET request through CURL. I am using the TP framework and the URL format is pathinfo format.

Source code

<?php
/**
 * Created by PhpStorm.
 * User: Administrator
 * Date: 2017/3/16 0016
 * Time: 15:56
 */
namespace Client\Controller;
use Think\Controller;

class ClientController extends Controller{
    const TOKEN = &#39;API&#39;;
    //模拟前台请求服务器api接口
    public function getDataFromServer(){
        //时间戳
        $timeStamp = time();
        //随机数
        $randomStr = $this -> createNonceStr();
        //生成签名
        $signature = $this -> arithmetic($timeStamp,$randomStr);
        //url地址
        $url = "http://www.apitest.com/Server/Server/respond/t/{$timeStamp}/r/{$randomStr}/s/{$signature}";
        $result = $this -> httpGet($url);
        dump($result);
    }

    //curl模拟get请求。
    private function httpGet($url){
        $curl = curl_init();

        //需要请求的是哪个地址
        curl_setopt($curl,CURLOPT_URL,$url);
        //表示把请求的数据已文件流的方式输出到变量中
        curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);

        $result = curl_exec($curl);
        curl_close($curl);
        return $result;
    }

    //随机生成字符串
    private function createNonceStr($length = 8) {
        $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
        $str = "";
        for ($i = 0; $i < $length; $i++) {
            $str .= substr($chars, mt_rand(0, strlen($chars) - 1), 1);
        }
        return "z".$str;
    }

    /**
     * @param $timeStamp 时间戳
     * @param $randomStr 随机字符串
     * @return string 返回签名
     */
    private function arithmetic($timeStamp,$randomStr){
        $arr[&#39;timeStamp&#39;] = $timeStamp;
        $arr[&#39;randomStr&#39;] = $randomStr;
        $arr[&#39;token&#39;] = self::TOKEN;
        //按照首字母大小写顺序排序
        sort($arr,SORT_STRING);
        //拼接成字符串
        $str = implode($arr);
        //进行加密
        $signature = sha1($str);
        $signature = md5($signature);
        //转换成大写
        $signature = strtoupper($signature);
        return $signature;
    }
}

Copy after login

Server side

Accept foreground data for verification

Source Code

<?php
/**
 * Created by PhpStorm.
 * User: Administrator
 * Date: 2017/3/16 0016
 * Time: 16:01
 */
namespace Server\Controller;
use Think\Controller;

class ServerController extends Controller{
    const TOKEN = &#39;API&#39;;

    //响应前台的请求
    public function respond(){
        //验证身份
        $timeStamp = $_GET[&#39;t&#39;];
        $randomStr = $_GET[&#39;r&#39;];
        $signature = $_GET[&#39;s&#39;];
        $str = $this -> arithmetic($timeStamp,$randomStr);
        if($str != $signature){
            echo "-1";
            exit;
        }
        //模拟数据
        $arr[&#39;name&#39;] = &#39;api&#39;;
        $arr[&#39;age&#39;] = 15;
        $arr[&#39;address&#39;] = &#39;zz&#39;;
        $arr[&#39;ip&#39;] = "192.168.0.1";
        echo json_encode($arr);
    }

    /**
     * @param $timeStamp 时间戳
     * @param $randomStr 随机字符串
     * @return string 返回签名
     */
    public function arithmetic($timeStamp,$randomStr){
        $arr[&#39;timeStamp&#39;] = $timeStamp;
        $arr[&#39;randomStr&#39;] = $randomStr;
        $arr[&#39;token&#39;] = self::TOKEN;
        //按照首字母大小写顺序排序
        sort($arr,SORT_STRING);
        //拼接成字符串
        $str = implode($arr);
        //进行加密
        $signature = sha1($str);
        $signature = md5($signature);
        //转换成大写
        $signature = strtoupper($signature);
        return $signature;
    }
}

Copy after login

Result

string(57) "{"name":"api","age":15,"address":"zz","ip":"192.168.0.1"}"

Copy after login

Summary

This method is just one of the methods. In fact, it is also There are many ways to perform security verification.

Recommended learning: "

PHP Video Tutorial"

The above is the detailed content of What to do if php api security verification fails. For more information, please follow other related articles on the PHP Chinese website!