Secure web services using Symfony

Question

So I have Symfony project which is also in charge of database abstraction and the data layer. In short - all data requests should go through it.

Now I want to have external components that will want to query / update stuff in the database, using web service API that I expose.

Question: How do I make sure these web services are running inside a secure channel? I don't want unauthorized users to update my database, and I don't want eavesdroppers get hold of sensitive data. Is setting up client authentication using PKI a viable option? or is it overkill? What's the way this is tackled?

Thanks! -DBG

Embed an authentication token into url

Dziamid
– Dziamid

2011-04-10 19:54:05 +00:00
Commented Apr 10, 2011 at 19:54 — Dziamid
– Dziamid, Commented Apr 10, 2011 at 19:54

Dziamid · Accepted Answer · 2011-04-10 19:55:07Z

2

First of all, you if you have a limited number of service users, and know their ips, you can restict access to ceirtain urls by ips. Next, have a look at Practical symfony, where they embed an authentication token into the url.

answered Apr 10, 2011 at 19:55

Dziamid

11.7k13 gold badges73 silver badges108 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

deebugger Over a year ago

Don't know the number / nature of my users - they could be spread all over the place with new ones joining etc. However the token thing looks like the right way to go, providing I put it all into an HTTPS tunnel - so thanks (again)!\

Collectives™ on Stack Overflow

Secure web services using Symfony

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related