Currently I am working on php application, to create interface that will receive POST data from mobile app, and process them into shared database.

To do things right at a first time, I was searching for rule of thumb to design the web service. Quickly I found the recommendation by using RESTful API . I have read through few simple REST tutorials. Maybe due to my limited knowledge, I did not really see benefit by using REST. It does not cover my main security concern also, to ensure the php is able to filter out invalid request, and only receive the unmodified request sent by authorized devices.

I am seeking for advice to create the php API with industry standard, for maintainability, efficiency and also security.

  • I think you don't really know what REST means. Check this excelent answer on stackoverflow.com. Just like MVC, REST has got nothing to do with filtering out invalid requests, it's an architectural proposition for application development. A very abstract term. – Andy Jul 20 '16 at 17:23

It seems you have a fairly standard use case and you don't have a lot of experience with API's. In that case it might make sense to use one of the available frameworks which supplies you an API so you can focus on the business requirements. It also looks like a safer way to go and will give you some experience on possible implementations.

The security issue you have seems to be: I only want to receive requests from the real app / device. Correct?

That issue is about unsolvable unless you have full control over the devices.

If you have full control (like custom devices / MDM managed devices):

Install a certificate or some other security key on the devices and only allow access when they have a valid certificate.

Normal situation (smartphones, tables etc):

Don't base your security on the device itself but the user logged in (credentials). You generally don't care too much about the device a user is using. You care about the right user getting the right permissions.

What is REST in this context?

Your POST to the server has some things in need of definition: Which url do you send it to? What format of data do you send (JSON/XML/POST/etc)? How do you respond? What do you send when an error happens?

All those questions are (tried) to be answered by REST. So you use an industry standard to work with it.

A famous alternative is SOAP, so you can find some things to compare REST with.

So the implementation most likely:

  1. Create the API with a tool (Zend Framework, CakePHP, Laravel, etc) which helps you to setup an api quite quickly. From that point you can accept the POST request.

  2. Implement a security schema, most of the tools have some default solutions built in. So your POST contains a username + password OR some API security key.

  3. You implement the business logic. You get the raw data (like JSON from the POST) automatically converted into some kind of native type like an object or array so you can use it straight away. You can use the framework as well to answer in the right format or to raise errors when needed. It will send them back to your client in the right expected format.

  4. On your client, to send the POST, you can also use some standard tools to make the request. If your client is a Javascript device you can use anything from jQuery ($.post) to just a native implementation. When you have a PHP script as API client you can use help from for example Guzzle: http://docs.guzzlephp.org/en/latest/request-options.html#auth Here you can find a basic auth example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.