PHP Basic Rest API with Custom Header - php

Question

I'm fairly new to PHP Rest API. I would like to upgrade my knowledge so I need to create an authorisation for my web service. I'd like to ask first if they are authorised to view my web service, if not then they won't see it.
This is what I've done so far:
<?php
include('db.php');
$sql = "SELECT * FROM bb_users";
$stmt = $conn->prepare($sql);
$stmt->execute();
$set = array();
while($r = $stmt->fetchAll(PDO::FETCH_ASSOC)){
$set = $r;
}
// $username='ABC';
// $password='XYZ';
//header("Authorization: Basic " . base64_encode($username . ":" . $password));
header('Content-type: application/json');
header('Access-Control-Allow-Origin: *');
echo json_encode($set);
?>
Any ideas? I would gladly appreciate your help. And if you could provide some tips or links to get started with.

Answer 1

This is a basic implementation of what you are trying to do. Keep in mind that this uses Basic access Authentication and it does not provide any protection against username an password since those are pretty much transmitted over the net.
To build a better more robust API I recommend https://www.apigility.org/ in my opinion it's one of the best, if not the best out there,
As far as the Authentication goes, I recommend OAuth.
FYI: I am assuming your code was correct and did not have any errors, so I just moved it inside the if block. There is a call to check_if_credentials_are_valid_function which is the function you will define and call to make sure the username and password are valid. If credentials are valid it will return the json encoded data and exit, otherwise it will continue to the end of the script and return a 401 status code.
<?php
$headers = apache_request_headers();
if(isset($headers['Authorization'])) {
$authorization = $headers['Authorization'];
if (preg_match('/Basic\s+(.*)$/i', $authorization, $auth)) {
// Split the string, base64 decode it
list($user, $pass) = explode(':', base64_decode($auth[1]));
if (check_if_credentials_are_valid_function($user, $pass)) {
include('db.php');
$sql = "SELECT * FROM bb_users";
$stmt = $conn->prepare($sql);
$stmt->execute();
$set = array();
while($r = $stmt->fetchAll(PDO::FETCH_ASSOC)){
$set = $r;
}
// $username='ABC';
// $password='XYZ';
//header("Authorization: Basic " . base64_encode($username . ":" . $password));
header('Content-type: application/json');
header('Access-Control-Allow-Origin: *');
echo json_encode($set);
exit();
}
}
}
header('HTTP/1.0 401 Unauthorized');
exit();
?>