Book Image

Building RESTful Web Services with PHP 7

By : Waheed ud din
Book Image

Building RESTful Web Services with PHP 7

By: Waheed ud din

Overview of this book

REST is the most wide spread and effective standard to develop APIs for internet services. With the way PHP and its eco-system has modernized the way code is written by simplifying various operations, it is useful to develop RESTful APIs with PHP 7 and modern tools. This book explains in detail how to create your own RESTful API in PHP 7 that can be consumed by other users in your organization. Starting with a brief introduction to the fundamentals of REST architecture and the new features in PHP 7, you will learn to implement basic RESTful API endpoints using vanilla PHP. The book explains how to identify flaws in security and design and teach you how to tackle them. You will learn about composer, Lumen framework and how to make your RESTful API cleaner, secure and efficient. The book emphasizes on automated tests, teaches about different testing types and give a brief introduction to microservices which is the natural way forward. After reading this book, you will have a clear understanding of the REST architecture and you can build a web service from scratch.
Table of Contents (16 chapters)
Title Page
Credits
About the Author
About the Reviewer
www.PacktPub.com
Customer Feedback
Preface

Common security threats in RESTful web services


Since we have looked at problems in our current code how we will be implementing in some of our endpoints and use authentication middleware, now it is the time to see what the common security threats that we need to consider while building RESTful web services are.

Use of HTTPS

HTTPS is HTTP with SSL. As our data is being transferred the internet, we need to make our connection secure; for that reason, we should use HTTPS. The purpose of is to make sure that the server is who it claims to be and that data is transferred between the client and server with a secure connection in an encrypted form.

If you don't want to buy an SSL certificate as it is costly for you, then can simply go for https://letsencrypt.org/. Let's Encrypt is a free certificate authority. So, you can use it without paying for an SSL certificate.

Securing an API key/token

As our sessions will be based on a token, we need to secure authentication token. There different things...