如何在 PHP 中构建安全且 RESTful 的服务？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5816233/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to build a secure and RESTful service in PHP?
提问by Steve
I'm building an application system which consists of a server part "in the cloud" and a client part, e.g. an iPhone or Android app or a web browser.
我正在构建一个应用程序系统，它由“在云中”的服务器部分和客户端部分组成，例如 iPhone 或 Android 应用程序或 Web 浏览器。
Server side is implemented in PHP (LAMP) and is today a very simple server with a number of php-files serving each type of method request like: getCustomers.php, addNewCustomer.php and so on. Also, up until now, no security mechanism has been used whatsoever and the ISP hosting the server do not provide SSL. That's right, SSL is not an option for security.
服务器端是用 PHP (LAMP) 实现的，现在是一个非常简单的服务器，有许多 php 文件为每种类型的方法请求提供服务，例如：getCustomers.php、addNewCustomer.php 等等。此外，到目前为止，还没有使用任何安全机制，托管服务器的 ISP 不提供 SSL。没错，SSL 不是安全选项。
Now, I want to gear up my old system and make it:
1) True RESTful service, and
2) Add security, users must be authenticated and authorized, but passwords in plain text is of course not acceptable.
现在，我想升级我的旧系统并使其：
1）真正的 RESTful 服务，以及
2）添加安全性，用户必须经过身份验证和授权，但纯文本密码当然是不可接受的。
My question simply is, how do I achieve and realize point 1) and 2) above? Is there any tutorial, book chapter or blog article that describes this combined in a single piece? Or do I need to collect information sprinkled all over the web and then try to combine them the best I can?
我的问题很简单，我如何实现和实现上面的 1) 和 2) 点？是否有任何教程、书籍章节或博客文章将其组合成一个整体来描述？或者我是否需要收集散布在整个网络上的信息，然后尽我所能地将它们组合起来？
And please, if you know the answer, and now I hope I'm not too rude, do not just say oAuth this or openID that, instead I would appreciate a lucid explanation of the how or pointers to e.g. blog articles explaining this. Needless to say I have searched the web like a maniac but have, to my big surprise, not been able to find a good answer!?
请，如果你知道答案，现在我希望我不是太粗鲁，不要只说 oAuth this 或 openID that，相反，我希望能清楚地解释如何解释或指向例如解释这一点的博客文章。不用说，我像疯子一样在网上搜索，但令我惊讶的是，找不到好的答案！？
Regards,
Steve
问候，
史蒂夫
回答by Gordon
Is there a tutorial, book chapter or blog article that describes this comined in a singe piece?
是否有单独的教程、书籍章节或博客文章对此进行了描述？
I can recommend REST in Practice - Hypermedia System Architectureas a guide to building HATEOASsystems. It has no PHP samples, but it includes a full chapter on Web Security Issues, covering HTTP Basic and Digest Auth, OpenID and OAuth and attack vectors to be aware of.
我可以推荐REST in Practice - Hypermedia System Architecture作为构建HATEOAS系统的指南。它没有 PHP 示例，但包含关于 Web 安全问题的完整章节，涵盖 HTTP 基本和摘要式身份验证、OpenID 和 OAuth 以及需要注意的攻击向量。
回答by Neville Kuyt
Instead of inventing/building your solution, I'd use one of the many PHP frameworks for RESTful services. http://www.recessframework.org/is pretty comprehensive, though you will almost certainly have to extend it to include authentication.
我不会发明/构建您的解决方案，而是使用众多 PHP 框架中的一种来提供 RESTful 服务。http://www.recessframework.org/非常全面，但您几乎肯定必须扩展它以包含身份验证。
http://phprestsql.sourceforge.net/does support authentication out of the box, but relies on HTTPS to encrypt plaintext passwords; you should be able to extend it when you work out how to deal with authentication.
http://phprestsql.sourceforge.net/确实支持开箱即用的身份验证，但依赖 HTTPS 来加密明文密码；当您研究如何处理身份验证时，您应该能够扩展它。
Apropos authentication: as REST is intended to use the HTTP standards as much as possible, I'd recommend using the HTTP authentication mechanisms - described at length in http://php.net/manual/en/features.http-auth.php(as well as in the W3C docs).
Apropos 身份验证：由于 REST 旨在尽可能多地使用 HTTP 标准，我建议使用 HTTP 身份验证机制 - 在http://php.net/manual/en/features.http-auth.php 中有详细描述（以及在 W3C 文档中）。
