Clash Royale CLAN TAG#URR8PPP

Symfony | Authenticate request

I'm trying to create a "service" like application, which can be able to receive API calls from another services. (These services will be built, for different purposes). And also able to send API calls to an another one.

Each request that they send, and accept has to have the following format.


header :
// some header information, like locale, currency code etc.
signature : "some-hashed-data-using-the-whole-request"
,
request :
// the usable business data




To each request I want to append a hash, that is generated from the actual request or anyhow (salted with password or any kind of magic added). Its not that important at the moment. I gave the name signature to this field. So for each received request, I want to reproduce this signature from the request. If the signature I received is matching with the one I generated, I let the application run otherwise showing some error message.

signature

signature

signature

I already read a few articles, but most of them is for user-pass combinations.

My question is not about that if it's a good solution or not. I just want to know how can implement a middleware like functionality - like in laravel - in Symfony 4?

1 Answer
1

Instead of putting headers into a JSON object the HTTP body, use HTTP headers directly. That’s what they are for. When you’re using non-standard headers, prefix them with X- and maybe a prefix for your application, for example X-YourApp-Signature. The request goes into the body, i.e. the value of the request property in your example.

X-

X-YourApp-Signature

request

The server side is pretty simple with Symfony:

public function someAction(Request $request)

$signature = $request->headers->get("X-YourApp-Signature");
$data = json_decode($request->getContent());

// ... go on processing the received values (validation etc.)



If you want to write a HTTP client application in PHP, I would recommend using the Guzzle library. Here’s an example:

$headers = ["X-YourApp-Signature" => "your_signature_string"];
$data = json_encode(["foo" => "bar"]);
$request = new GuzzleHttpPsr7Request("POST", "https://example.com", $headers, $data);
$client = new GuzzleHttpClient();
$response = $client->send($request, ["timeout" => 10]);
var_dump($response);


Of course, you’ll also want to implement some error handling etc. (HTTP status >= 400), so the code will be a bit more complex in a real application.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.