-2

I am really new using web servers and security. I have just written a backend for my iOS app in PHP. It's hosted on a Linode apache server. The index.php us located at http://www.example.com/API/. I'm just wondering what I should do to secure it. I will access it via my iOS app but what about the possibility of someone entering that URL and accessing it or performing commands in curl? Do I have to implement security in the PHP script or on the server?

Any pointers on this would be really appreciated.

EDIT, my API performs simple MySQL operations such as INSERT and SELECT, they are done via POST and GET using parameters. I'm currently not implementing any user authorisation. I want to protect it from unauthorised access to the database.

  • Your question is way too broad. Could you rewrite it to give us a little more? What kinds of operation the API offers? Is there any user authentication? Will you use sessions? What kind of damage you think you should protect from? – ThoriumBR Jul 31 '15 at 13:48
  • edited the question – Bob Jul 31 '15 at 13:58
  • If I understand you correctly, you have a PHP script running on an open server with public access and it permits database access. It is now at this point you want to secure the PHP script? – schroeder Jul 31 '15 at 15:07
  • @schroeder yes that's right – Bob Aug 1 '15 at 7:43
  • I think this is where the term "shutting the barn door after the horse has left" applies. You need to rethink how users access this script. – schroeder Aug 1 '15 at 16:49
4

First, you have no way to avoid people using curl to access the API. On the server perspective, your application and someone using curl or telnetting in is exactly the same.

You must employ some controls and protections on the API that will make harder to people just fire up curl and mess with you database. As you are learning, I will not give you links, but the things you must research. A few options come to mind:

  • Secure coding

    First of all, learn how to secure code. PHP is very easy to learn, and at the same time is very easy to make deadly mistakes. Learn how to secure code is the first thing you must learn before doing anything. Write secure code from the start, not "make it work" first and try secure it later. Make it secure from the start.

  • HTTPS

    You must employ HTTPS. It gives you server authentication, confidentiality and protects against accidental or intentional changes on the traffic. Pair it with public key pinning and you set a high barrier.

  • User Authentication

    If you have anything private, you must authenticate the users. Salted passwords, secure sessions and secure cookies come to mind. Even a captcha. Employ rate-limiting on the login too, so it will be harder to someone bruteforce the login.

  • Input validation and sanitization

    This is very important. No matter how secure is the controls around the API, if someone can slips a SQL injection, you are dead. All your users are dead, all your data is dead. If someone can exploit a remote file include, you are even deader than before. So never trust anything you receive from the client, even if the client is authenticated.

Study the OWASP guides and tutorials, specially the Top 10 vulnerabilities. Try not to expose your application to that risks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.