How to send HTTPS response from a wordpress website to another - php

Question

I know it's a little bit complicated but there's a lot of benefits for me using this scenario,
I'm working on a WordPress project and need to verify the user's license so I made an AJAX form has the required fields from user, Unfortunately the verification API needs a Secret Key (Belongs to me and cannot include in the client's project) so I made an external WordPress website (Subfolder on my website) and develop two small [Plugin & Theme].
- In the client side
I prepare the user sensitive data to send to my website using WordPress function (wp_safe_remote_get) like this...
$request_url = 'HTTPS://MY_WEBSITE/verify?api=XXX&some=XXX&some=XXX';
$response = wp_safe_remote_get(
$request_url,
array(
'timeout' => 300
)
);
- On my Website
The theme has an [3 files: style.css, functions.php and verify.php] and the verify.php has this line [ do_action( 'xxx' ) ].
The plugin has [ add_action( 'xxx' ) ] in the constructor to do the verification process and of course I included the My SECRET KEY here ..
Collect $_GET params and verify then return an array with the result using [print_r] so the final result exactly like this from browser Inspect Element
body_tag>
Array (
[API_RESULT] => Array ( 'verified' => true );
)
/body>
The Issue
In the client side I received the previous array BUT besides a lot of included scripts and css paths belongs to my WordPress website, So...
I need to receive only the response body without the other included files.
Is that secure enough?
Is there a solution for this scenario something like create a PHP file rather than a WordPress site but will be more secure??
Thanks for your help.

Answer 1

1. Server Side
If you need to send an array to the client side, Do your processes you need then print serialized array.
index.php
do_action( 'YOUR_ACTION_NAME', 'VAR_1', 'VAR_2' );
class_processes.php
function __construct() {
add_action( 'YOUR_ACTION_NAME', array( &$this, '__Trigger_User_Action' ), 10, 2 );
}
public function __Trigger_User_Action( $seller_name = '', $token_type ) {
$user_final_data = array();
// Do Some
die( serialize( $user_final_data ) );
}
2. Client Side
$request_url = 'https://DOMAIN.XXX/user_processes?user_name=XXX&code=XXX';
$response = wp_safe_remote_get(
$request_url,
array(
'timeout' => 300
)
);
if( ! is_wp_error( $response ) ) {
$body_data = wp_remote_retrieve_body( $response );
if( ! is_wp_error( $body_data ) ) {
$user_server_data = #unserialize( $body_data );
}
}
Now $user_server_data contains the the array you passed in [print] function through your server.