PHP - secure transfer of data from a site to another site

Question

I have a site that can accept requests from multiple sites. Looks like checking for updates. These sites will send information such as usernames, passwords, application version, etc. Then my site will send a response based on this information.

This is basically a $_GET request, for example:

http://www.mysite.com/?user=boo&password=foo&version=4

I was wondering if any security issues would do such things. Could this data be "intercepted"?

Answer 1

Well, I would suggest not sending the username / password in text form under any circumstances (even when using SSL). Instead, I would suggest using the Digest authentication form.

Instead, I would suggest creating a large authentication token (random large string, 128 characters will work). Then users will install this “token” in their application.

Now, when the application checks for updates, it first launches a request to your server, requesting a digest token. This is a random one-time token that is used for only one request. Your application should generate a token, save it in a strong format (file, memory, database, etc.) along with a timestamp, and then send it back.

Now your application receives this digest token (here $dt ). Then you hmac with a pre-configured authentication token that has already been specified.

 $authBit = $username . ':' . $authToken; $hash = hash_hmac('sha256', $authBit, $digestToken); $authField = $username . ':' . $hash . ':' . $digestToken; 

Then you send $authField to the server. Then the server will split the parts:

 list ($user, $hash, $digestToken) = explode(':', $authField); 

Now you first look at the user authentication token in the database and save it in $authToken . Then you look at $digestToken to make sure that it exists and that it was created less than 60 seconds ago (you can configure it if it is too short, but not make it much longer). In any case, remove it from db at this point (to prevent reuse).

Now, if $digestToken exists and is valid, and you can find $authToken , then do the following check:

 $stub = $user . ':' . $authToken; if ($hash == hash_hmac('sha256', $stub, $digestToken)) { //valid user } else { //Not valid } 

This allows you to change the sent token every time, once with one HTTP request (anyone who reads the request stream will not be able to get any confidential information from the request, except for the username that you could mask further, d like) .. .

Answer 2

"Protection from no show" does not work, and using POST instead of GET makes the information a little more complicated if you are actually looking at the user over your shoulder.

The real problem here is preventing traffic interception between the servers. The only way to handle this is with encryption such as SSL. It is recommended that you always use SSL when transmitting sensitive information such as passwords. It may be a little harder to implement, but it is definitely worth it in terms of security.

However, the best way to keep sensitive data from being captured is to not transfer it in the first place. Think about whether it is possible to check your application for updates without passing a password. If an update is available, you can send the user to a web page using HTTPS to download the update, which eliminates the need to perform SSL yourself.

Answer 3

Use .htaccess to change and hide the URL of your site. eg:

 www.mysite.com/index.php?cat=1234&foo=5678 

will look like this:

 www.mysite.com/cat-1234-foo-5678-index.html 

when u successfully creates the .htaccess file, both URLs will act the same.