Home > Article > Backend Development > What to do if php api security verification fails
Solution to php api security verification failure: 1. Use a PHP file to replace the frontend; 2. Simulate GET request through CURL; 3. Accept the frontend data for verification.
#The operating environment of this article: Windows7 system, PHP7.1, Dell G3.
What should I do if the php api security verification fails?
In actual work , it is common to use PHP to write API interfaces. After PHP writes the interface, the front desk can obtain the data provided by the interface through the link, and the returned data is generally divided into two situations, xml and json. In this process, the server does not I don’t know what the source of the request is. It may be that someone else illegally calls our interface to obtain data, so security verification is required.
<?php /** * Created by PhpStorm. * User: Administrator * Date: 2017/3/16 0016 * Time: 15:56 */ namespace Client\Controller; use Think\Controller; class ClientController extends Controller{ const TOKEN = 'API'; //模拟前台请求服务器api接口 public function getDataFromServer(){ //时间戳 $timeStamp = time(); //随机数 $randomStr = $this -> createNonceStr(); //生成签名 $signature = $this -> arithmetic($timeStamp,$randomStr); //url地址 $url = "http://www.apitest.com/Server/Server/respond/t/{$timeStamp}/r/{$randomStr}/s/{$signature}"; $result = $this -> httpGet($url); dump($result); } //curl模拟get请求。 private function httpGet($url){ $curl = curl_init(); //需要请求的是哪个地址 curl_setopt($curl,CURLOPT_URL,$url); //表示把请求的数据已文件流的方式输出到变量中 curl_setopt($curl,CURLOPT_RETURNTRANSFER,1); $result = curl_exec($curl); curl_close($curl); return $result; } //随机生成字符串 private function createNonceStr($length = 8) { $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; $str = ""; for ($i = 0; $i < $length; $i++) { $str .= substr($chars, mt_rand(0, strlen($chars) - 1), 1); } return "z".$str; } /** * @param $timeStamp 时间戳 * @param $randomStr 随机字符串 * @return string 返回签名 */ private function arithmetic($timeStamp,$randomStr){ $arr['timeStamp'] = $timeStamp; $arr['randomStr'] = $randomStr; $arr['token'] = self::TOKEN; //按照首字母大小写顺序排序 sort($arr,SORT_STRING); //拼接成字符串 $str = implode($arr); //进行加密 $signature = sha1($str); $signature = md5($signature); //转换成大写 $signature = strtoupper($signature); return $signature; } }
<?php /** * Created by PhpStorm. * User: Administrator * Date: 2017/3/16 0016 * Time: 16:01 */ namespace Server\Controller; use Think\Controller; class ServerController extends Controller{ const TOKEN = 'API'; //响应前台的请求 public function respond(){ //验证身份 $timeStamp = $_GET['t']; $randomStr = $_GET['r']; $signature = $_GET['s']; $str = $this -> arithmetic($timeStamp,$randomStr); if($str != $signature){ echo "-1"; exit; } //模拟数据 $arr['name'] = 'api'; $arr['age'] = 15; $arr['address'] = 'zz'; $arr['ip'] = "192.168.0.1"; echo json_encode($arr); } /** * @param $timeStamp 时间戳 * @param $randomStr 随机字符串 * @return string 返回签名 */ public function arithmetic($timeStamp,$randomStr){ $arr['timeStamp'] = $timeStamp; $arr['randomStr'] = $randomStr; $arr['token'] = self::TOKEN; //按照首字母大小写顺序排序 sort($arr,SORT_STRING); //拼接成字符串 $str = implode($arr); //进行加密 $signature = sha1($str); $signature = md5($signature); //转换成大写 $signature = strtoupper($signature); return $signature; } }
string(57) "{"name":"api","age":15,"address":"zz","ip":"192.168.0.1"}"
PHP Video Tutorial"
The above is the detailed content of What to do if php api security verification fails. For more information, please follow other related articles on the PHP Chinese website!