Secure call to PHP web service functions from ajax jquery, adding authentication

Question

jQuery.ajax({
type: "POST",
url: 'your_functions_address.php',
dataType: 'json',
data: {functionname: 'add', arguments: [1, 2]},

success: function (obj, textstatus) {
              if( !('error' in obj) ) {
                  yourVariable = obj.result;
              }
              else {
                  console.log(obj.error);
              }
        }
   });

and your_functions_address.php like this:

<?php

header('Content-Type: application/json');

$aResult = array();

if( !isset($_POST['functionname']) ) { $aResult['error'] = 'No function name!'; }

if( !isset($_POST['arguments']) ) { $aResult['error'] = 'No function arguments!'; }

if( !isset($aResult['error']) ) {

    switch($_POST['functionname']) {
        case 'add':
           if( !is_array($_POST['arguments']) || (count($_POST['arguments']) < 2) ) {
               $aResult['error'] = 'Error in arguments!';
           }
           else {
               $aResult['result'] = add(floatval($_POST['arguments'][0]), floatval($_POST['arguments'][1]));
           }
           break;

        default:
           $aResult['error'] = 'Not found function '.$_POST['functionname'].'!';
           break;
    }

}

 echo json_encode($aResult);
 ?>

How to avoid that anybody who find the url : 'your_functions_address.php' can call any function on the web service ?

is there a way of adding an authentication or security ?

I am applying SSL security of course but does SSL solve this problem ?

Give the user of your web service some sort of authorization token. Alternatively implement an user/password system. Multiple options are possible here, as are libraries for this aswell. — Daan
– Daan, Commented May 2, 2016 at 13:19
e.g In DB we stored one value, then you can pass one secret key of flag value from ajax request. And you can get this value in php file and match this value with db value. If match is true then authenticate otherwise you can back the response blank or do unauthentication stuff. — Sanjay Chaudhari
– Sanjay Chaudhari, Commented May 2, 2016 at 13:20

jcubic · Accepted Answer · 2016-05-02 13:24:12Z

3

You can implement login function that will return a token that need to be send to other functions:

session_start();
if( !isset($aResult['error']) ) {

    switch($_POST['functionname']) {
        case 'login':
           if( !is_array($_POST['arguments']) || (count($_POST['arguments']) < 2) ) {
               $aResult['error'] = 'Error in arguments!';
           }
           else {
               if ($_POST['arguments'][0] == 'user' && $_POST['arguments'][1] == 'passsword') {
                   $time = array_sum(explode(' ', microtime()));
                   $aResult['result'] = md5($time);
                   $_SESSION['token'] = $aResult['result'];
               }
           }
           break;
        case 'add':
           if( !is_array($_POST['arguments']) || (count($_POST['arguments']) < 2) ) {
               $aResult['error'] = 'Error in arguments!';
           }
           else {
               if ($_SESSION['token'] == $_POST['arguments'][0]) {
                   $aResult['result'] = add(floatval($_POST['arguments'][1]), floatval($_POST['arguments'][2]));
               }
           }
           break;

        default:
           $aResult['error'] = 'Not found function '.$_POST['functionname'].'!';
           break;
    }

}

then in javascript you first call login function to get the token and then pass it as first argument to other functions:

answered May 2, 2016 at 13:24

jcubic

67.1k58 gold badges252 silver badges466 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Tony Over a year ago

Thank you very much for this helpful answer. But if I'm using this from a mobile app (phone gap) does the session end when the user close the app ?

jcubic Over a year ago

the session will end after timeout stackoverflow.com/questions/9904105/…

Tony Over a year ago

Okayy.. that extremely helpful, you solved my problem :D Thank you!

Collectives™ on Stack Overflow

Secure call to PHP web service functions from ajax jquery, adding authentication

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related