As in any SSL connection, the system is secure if you use TLS 1.2 with only secure ciphers allowed (that is, good SSL configuration).
Other than that, SSL is MITM protected if the systems involved only trust the legitimate certificates used on the SSL connection. If one may inject on your truted certificate list or convince your system to accept a fake certificate, it will be able to do a MITM attack by presenting you the client the fake certificate, deciphering the data and reciphering it to your server, acting like a proxy.
So you may want to make sure you have trusted certificates correclty and restrictively set, and maybe also want to use public key pinning (explicitly deciding to trust specific public keys instead of fully trusting certificates or certificate authorities). You may want to check what are the trusted anchors that PHP is using, and it looks like depending on the version it may not even check the certificate at all, and that would make a MITM trivial. More info on that here: https://www.venditan.com/labs/2014/06/26/ssl-and-php-streams-part-1-you-are-doing-it-wrongtm/432
Note that the protocol in the url is https and that the data and api
key are simply included in the url as segments.
I´m supposing you are worried that the API token would leak here because it is visible on the URL. Actually the api/apikey/somedata part is protected by SSL, what happens behind the scenes is that you stablish a SSL connection to myapp.com (without saying what you want from it on clear text) and then, just after sucessfully connected, using the protected and ciphered connection, you request to "get api/apikey/somedata". So the api key will not be visible for anyone listening. However, the full URL may leak by other channels, like a browser history, logs and so on. Thats why usually authentication tokens are added to HTTP headers instead of path or query params. They are as protected as in the path from the SSL point of view, but it less likely that it leaks by mistake.
file_get_contents
. I'm not a PHP programmer, so I'm not sure if that is your function (which we need to see contents of) or if it comes from a library? – Bryan Field Nov 14 '16 at 16:23file_get_contents
is a native PHP function. I'm somewhat of a beginner with this stuff, can you elaborate on "HTTPS client library"? – Christian Nov 14 '16 at 16:29