How to ensure security of php interface

The security of the interface is mainly designed around the three mechanisms of Token, Timestamp and Sign to ensure that the data of the interface will not be tampered with and repeatedly called. Let’s look at it in detail below:

(1)Token authorization mechanism: (Token is the credential for the client to access the server)--After the user logs in using the username and password, the server returns a Token to the client (usually UUID), and store Token-UserId in the cache server in the form of key-value pairs. After receiving the request, the server performs token verification. If the token does not exist, the request is invalid. (Recommended learning: PHP programming from entry to proficiency)

(2) Timestamp timeout mechanism:(The signature mechanism ensures that the data will not be tampered with) Each user Each request carries a timestamp of the current time. The server receives the timestamp and compares it with the current time. If the time difference is greater than a certain time (such as 5 minutes), the request is considered invalid. The timestamp timeout mechanism is an effective means to defend against DOS attacks.

(3) Signature mechanism: Add Token and timestamp to other request parameters and then encrypt using MD5 or SHA-1 algorithm (you can add some salt according to the situation). The encrypted data is For the signature of this request, the server uses the same algorithm to obtain the signature after receiving the request, and compares it with the current signature. If it is different, it means that the parameters have been changed, and an error ID is returned directly.

/**
 * @desc 接受参数处理
 */
private function dealParam(){
    //接受header参数--系统参数
    $systemParam=getAllHeadersParam();
    //接受body数据--业务参数(json格式)
    $data=file_get_contents('php://input');
    
    //读取配置文件中的私钥信息
    $api_apiKey=C('api_apiKey');
    $privatekey=$api_apiKey[$systemParam['token']];


    $arr['token']    =$systemParam['token'];        //服务端分配的标识(不同客户端需使用不同的标识)
    $arr['timestamp']=$systemParam['timestamp'];    //时间戳，UTC时间，以北京时间东八区（+8）为准
    $arr['version']  =$systemParam['version'];      //版本号
    $arr['sign']     =$systemParam['sign'];         //签名
    $arr['source']   =$systemParam['source'];       //来源(0-安卓/1-IOS/2-H5/3-PC/4-php/5-java)
    $arr['data'] =json_decode($data,true); //业务参数json格式 
    $arr['method'] =$data['method']; //访问接口,格式:模型名.方法名 

    return $arr;
 }

/*
 * @desc 获取所有以HTTP开头的header参数
 * @return array
 */
private function getAllHeadersParam(){
   $headers = array();
   foreach($_SERVER as $key=>$value){
       if(substr($key, 0, 5)==='HTTP_'){
           $key = substr($key, 5);
           $key = str_replace('_', ' ', $key);
           $key = str_replace(' ', '-', $key);
           $key = strtolower($key);
           $headers[$key] = $value;
       }
   }
   return $headers;
}

/*
 * @desc 签名校验
 * @param $token string 服务端分配的标识(不同客户端需使用不同的标识)
 * @param $timestamp string 时间戳，UTC时间，以北京时间东八区（+8）为准
 * @param $version string 版本号
 * @param $sign string 签名
 * @param $source int 来源(0-安卓/1-IOS/2-H5/3-PC/4-php/5-java)
 * @param $privatekey string 私钥
 * @param $data 业务参数json格式
 * @return bool
 */
private function checkAuth($token,$timestamp,$version,$sign,$source,$privatekey,$data){
        //参数判断
        if(empty($token)){
            E('token不能为空！');
        }
        if(empty($timestamp)){
            E('时间戳不能为空！');
        }
        if(empty($version)){
            E('版本号不能为空！');
        }
        if(empty($data)){
            E('业务参数不能为空！');
        }
        if(empty($source) && $source<>&#39;0&#39;){
            E(&#39;来源不能为空！&#39;);
        }
        if(empty($sign)){
            E(&#39;签名不能为空！&#39;);
        }
        if(empty($privatekey)){
            E(&#39;私钥不能为空！&#39;);
        }
        //时间校验
        $expire_second=C(&#39;expire_second&#39;,null,10);
        $timestamp_t=$timestamp+$expire_second;
        if($timestamp_t<time()){
            E(&#39;请求已经过期！&#39;);
        }
        $public= D(&#39;public&#39;);
        $datas=$this->original;
        //系统参数
        $paramArr=array(
            &#39;token&#39;=>$token,
            &#39;timestamp&#39;=>$timestamp,
            &#39;version&#39;=>$version,
            &#39;source&#39;=>$source,
            &#39;data&#39;=>$data,
        );

        //按规则拼接为字符串
        $str = $this->createSign($paramArr,$this->privatekey);
        
        if($str != $this->sign){
            E(&#39;验签错误！&#39;);
        }
        return true;
    }

The above is the detailed content of How to ensure security of php interface. For more information, please follow other related articles on the PHP Chinese website!