I'm not so much looking for code (although if you want to link to tutorials it would be appreciated) as I am trying to get an idea of what people in the know are doing. Our system is written in PHP.

As part of an Electronic Medical Record System, I need to be able to securely exchange documents (Word, PDF, etc.) with business partners. I also need to transmit identifying information with the documents (patient name, medical record number, etc.)

If I Google exchanging files in a web service, I am given a bunch of information about a variety of methods. But, what's not easy to see is how old the information is, how commonly the methods are used, and if there is something out there that if I just knew what I was looking for, would blow my socks off.

TLDR - If you were going to use a web service to exchange files, and your system was written in PHP, how would you go about doing it, and why?

2 Answers 2


Use https and REST. Its secure, tested, and works on any platform. We have two formats that uses a file extension of either .xml or .json for easy consumption, when performing either a POST or GET request. we have http headers that identify if POST is actual a PUT, POST, or DELETE request since not all clients/servers/firewalls allow/recognize PUT and/or DELETE.

One gotcha with using REST is defining an API. The natural tendency is to use a uri style that mimics the familar RPC style. You need to work backwards, and define your uri with the object(s) being acted upon first, and use the verbs (GET,PUT,POST,DELETE) for your operations.

SOAP in comparison has more features, but about 95%(a measure I pulled out of the air) of the features are never used. It complicates understanding it, and adds overhead to development. I would only recommend using it if REST did not provide you with everything you need.

  • That parts a given :) But, I'm trying to write an API and am looking for the current technology that would best suit this project - Rest? Soap? Something else? Aug 25, 2011 at 20:14
  • updated my answer Aug 26, 2011 at 0:03
  • Please make an attempt to support this answer with facts, experiences, and/or references. I very rarely see REST used to exchange binary files, much less binary files with metadata.
    – Aaronaught
    Aug 26, 2011 at 0:05
  • 1
    @Aeronaught - everytime you download a file directly via a url (e.g. http://foo.com/someFile.whatever) you are exchanging a file via REST Aug 26, 2011 at 0:56
  • 1
    @Aaronaught - She specifically asked how would I do it and why. My first edition of my answer had all of that information. Under your advice, which I agreed with, I added more information. I also commented on a common example of transferring binary files since you said you had not seen it done much. Aug 26, 2011 at 1:56

Although you can secure any service, SOAP is really the only specification which actually has a standardized, configurable, built-in security model, that being WS-Security. Services secured this way will not be as easy to work with as REST services, but the support is there for all major platforms including .NET, Java, and C++. PHP support is also available through Apache Rampart/C.

As far as attachments go, you have two options: The first, and preferred option, is MTOM. Some Google hunting brings up a few libraries/frameworks for PHP that apparently support it, but I can't speak from direct experience. The other option, if you can't get MTOM to work, is old-school Base64 encoding. It's crude, but it does the job.

Obviously, WS-Security works over SSL if you want it to, although SSL is actually unnecessary because the specification provides for message-level encryption. Most people who use SSL for SOAP services do it simply because it's easier to configure and administer than (for example) mutual certificate authorization, which usually requires a PKI.

The disadvantage of SOAP and WS-Security is that it's very difficult to use in languages/platforms that don't have built-in support for it (e.g. JavaScript). Obviously you have to know who your clients are going to be.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.