As a self-taught discovering professional development, I daily run into things that puzzles me.
Simply put: I'm supposed to work on an old ZF1 application (with really ugly code, imbricated ternaries, condition inside assignation and stuffs without comments), but since Friday I didn't start anyway work because... I can't find out how to successfully "authentify the application" ! The application makes a SOAP call to the "portal", passing it a truncated version from the HTTP_HOST, which is then checked for its presence in a database. The corresponding row basically is made of domain names without subdomains, a plain text password, and a serialized array which is returned to the application.
If it fails, it throws an exception with message "110" (meaningful huh), nothing catches it so : fatal error.
As far as I understand what my boss says (I'm self-taught on english websites and books, he's not really a dev neither an architect or en english speaker, so dialog may get strange) : "this is to secure the application, so that nobody would be able to use our code to fake our application through a similar domain as our". Although I try to keep myself as much informed as possible, my knowledge about security isn't enough to answer myself... But I feel like their security is totally useless !! If they "use their code" it's because bad guys had access to it... so to the server... and nonetheless, if I get the code, I just need to get rid of the authentication process... or fake their domain name when doing the SOAP call... I can simply reproduce...
Does that even make sense ?? Isn't requests over SSL/TLS way more secure that this kind of makeshift job ??
Bonus question : what's the point in responding with a "Welcome to nowhere" 200 code instead of a 503 or anything else when requesting the server IP ?? Excepted telling bad guys "HEY, here's nowhere, but there's still something behind !!"
Thank you !