Angular and Slim framework for Mysql database security - php

Question

I am new to Angular and Data Api with Slim.
I create data Api with Slim used by Angular. My api code is below:
include 'dbConfig.php';
require 'Slim/Slim.php';
\Slim\Slim::registerAutoloader();
$slim_app = new \Slim\Slim();
$slim_app->get('/getUser','getUser');
$slim_app->post('/updateUser','updateUser');
$slim_app->post('/newUser','newUser');
$slim_app->run();
function getUser(){
global $mysqli;
$result = $mysqli->query("select * from users");
if(!$result){ echo "not connect";}
$rows = array();
while($row = $result->fetch_assoc()){
$rows[] = $row;
}
//echo "<pre>";
print json_encode($rows);
}
My Controller
myApp.controller('Ctrl',function ($scope, $http) {
$http.get('api/getUser').
success(function(data, status, headers, config){
$scope.obj = data;
});
});
When i go to localhost/api/getUser i can see all my json data so that mean anyone could see. how can i only allow my Angular app to use my api so it is secure?

Answer 1

Right,
This is a complicated subject but in it's simplest form you need a login route that returns an API key to your client like so....
NOTE this is very basic code that I use for testing purposes, it's missing proper hashing of passwords and checking for access token expiry plus a fair bit of other security. It's simply to illustrate an easy example.
app->get('/login/:username/:password', function ($username, $password) use ($app, $db) {
//check the login details against the db...
// TODO Include hashing FIX BEFORE PRODUCTION
$db->where("userName", $username);
$db->where("password", $password);
$result = $db->getOne('Users');
if ($db->count === 0) {
setResponseCode(401, array("Error" => "Incorrect login details."));
return;
}
// The way this key is generated needs updating, only for testing purposes.
$key = date("Y-m-d");
$key = $key . $username;
$key = md5($key);
// Need to add expiry time to access tokens....
$expire = date("Y-m-d H:i:s", strtotime('+15 minutes'));
$data = Array ('accessToken' => $key);
$db->where('id', $result['id']);
if (!$db->update('Users', $data)) {
// Internal error - this shouldn't happen!
setResponseCode(500, array("Error" => "Database error."));
return;
}
// Slim by default returns 200 so no need to call setResponseCode
echo json_encode(array("Authorisation" => $key));
});
function setResponseCode($code, $arrayJson) {
global $app;
/*
Function to save repetition of response headers - params are:
Int Code - HTTP Response Code
Array array_json - an array to be serialized into a JSON response ie array("Key" => "Item")
*/
$app->response->setStatus($code);
$app->response->SetBody(json_encode($arrayJson));
$app->response->headers->set('Content-Type', 'application/json');
}
function authorise($key) {
// Middleware for routes that require auth!
//global $key;
global $userId;
global $app;
global $db;
// need to add check for token expiry here!
$db->where('accessToken', $key);
$results = $db->getOne('Users', null, array('id'));
if ($db->count === 0) {
setResponseCode(401, array("Error" => "Authorisation Failure"));
$app->stop();
//return false;
}
$userId = $results['id'];
return true;
}
Your client needs to store the key and add it to the parameters to any request you can either use headers or just simple parameters. Again I'd google slim, API, access token, tutorial as the terms because this is a very basic answer to a complicated subject.
Now you just simply add authorise($key) to the top of any routes that need it, if it's false it'll return 401 and stop any further execution. I would recommend doing some more reading though as this is a very, very basic answer.