How to authorize an android app for a php-database-webservice?

Question

Recently I programmed a little app for my android device. As the datastorage for the app, Iam using a mysql database, which can be accessed via different php scipts. So all the app does, is it sends POST requests to the php scripts to communicate to the database.

But now I consider about the security aspect. These php scripts can be accessed by every webclient. So every webclient has the possibility to compromise my database, which is of course not the ideal case. So I was wondering if there is a way to just allow authorized clients to use these php-webservices? Does php provide any kind of authentification that can be used by an android client?
Cheers

rds · Accepted Answer · 2011-06-21 09:25:50Z

1

You simply need to require an authentification when invoquing the service:

simple and dirty: http basic auth, like Twitter used to do
a better solution is OAuth, like Twitter now does

There are of course other possibilities (WS-Security, but you don't seem to use SOAP).

answered Jun 21, 2011 at 9:25

rds

27.1k20 gold badges112 silver badges136 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

rds Over a year ago

Of course, you should have an encrypted connection, in that case... In the long term, you should switch to OAuth, even if it's not so easy (dev.twitter.com/pages/basic_to_oauth)

clement · Accepted Answer · 2011-06-21 09:05:36Z

0

for security, you should prefer to interact through an API to your mysql...isn't it?

answered Jun 21, 2011 at 9:05

clement

4,27610 gold badges67 silver badges138 bronze badges

Comments

James John McGuire 'Jahmic' · Accepted Answer · 2011-06-21 09:11:09Z

0

A few points:

Use a different port (i.e: not 80 or 8080) for the web access

Add authentication with a username and password. Inside your application, you can get these from a secure config file.

On the server side, you can also do some checking on user agents, IP addresses and maybe even device ids.

This is just a start

answered Jun 21, 2011 at 9:11

James John McGuire 'Jahmic'

12.8k11 gold badges78 silver badges84 bronze badges

1 Comment

rds Over a year ago

I don't see how changing the port secures the service in any way. user-Agent verification gives a false impression of security. As for IP adresses, that's in practice impossible to set up with mobile devices.

Collectives™ on Stack Overflow

How to authorize an android app for a php-database-webservice?

3 Answers 3

1 Comment

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related