PHP API Call with Httpful and Basic Auth Header

Question

I am using Httpful to call an API that uses basic authentication headers.

Here is how my GET request is set up:

<?php
include('httpful.phar');

$uri = "https://example.com";
$response = \Httpful\Request::get($uri)
    ->addHeader('Authorization', 'Basic KEY')
    ->send();
echo $response;
?>

This works correctly and I am able to display the response data on my PHP page.

However, is this the most secure way to add headers using basic auth? Should I be placing the auth key into a separate file or something more secure?

Alex Howansky · Accepted Answer · 2017-04-10 20:51:51Z

2

Should I be placing the auth key into a separate file

Probably. As a general rule, you should never commit authentication credentials to your source repository. So, if this file is source controlled, I'd pull out the hard-coded value and replace it with a variable.

How you set that variable depends on your environment. Often it's sufficient to read from a JSON, INI, or YML config file. Just make sure you set your .gitignore (or equivalent) to exclude that config file from the repository, and make sure that the file is outside the web server's document root, so that it can not be read directly.

Note, if you've already committed the key, then you'll want to change it, as its current value will live forever in your repository history.

answered Apr 10, 2017 at 20:51

Alex Howansky

54k8 gold badges85 silver badges102 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP API Call with Httpful and Basic Auth Header

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related