Protect call to remote php script

Question

I have on a server a PHP scrip that updates a DB.
I want to be able to call this script from remote, either from another server or my localhost PC using a GET, or from the browser using AJAX,
But I don't want anyone to be able to call this script unless allowed.

So far I simply added into the script a piece of code to verify a certain pin in the GET, i.e.

//myscript.php

if( isset($_GET['pin']) && $_GET['pin'] === '1234' )
{
   //update the DB...

In this way remote caller must know the pin, i.e.

file_get_contents(http://remoteserver.com/myscrip.php?pin=1234); //will work
file_get_contents(http://remoteserver.com/myscrip.php?pin=5678); //will NOT work

This seems so simple that I'm wondering if it's secure.

What are other possible more secure alternatives (maybe not too more complicated)?

For instance, I read about using an hash that changes over time, but is it worth it, how could it be done?

Marco Demaio · Accepted Answer · 2011-09-23 16:47:47Z

3

you could password protect the folder (can be done easy if you are using cpanel or plesk) and use curl to access that url.

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_USERPWD, $username . ':' . $password);
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_ANY);
$output = curl_exec($ch);
$info = curl_getinfo($ch);
curl_close($ch);

edited Sep 23, 2011 at 16:47

Marco Demaio

34.6k33 gold badges132 silver badges162 bronze badges

answered Sep 23, 2011 at 13:47

Mircea Soaica

2,8171 gold badge17 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Marco Demaio Over a year ago

it works like a charm. Thanks, I simply changed a bit the code to be more clear,

dj_segfault · Accepted Answer · 2011-09-23 13:54:20Z

2

Your solution is secure, but only up to a point, so it depends on just how important it is that others don't call it. For instance, if someone monitored the network traffic to that server, they would have the password, since it never changes. Remember it's being sent in cleartext over the Internet. So I personally would not have this PHP script update my Swiss bank account.

One option would be to have an algorithmic password based on the date and/or time so it would be different each time.

Another solution would be to have the script check the IP address of the request, which would be MUCH harder to hack without physical access to the server.

answered Sep 23, 2011 at 13:54

dj_segfault

12.5k4 gold badges33 silver badges37 bronze badges

2 Comments

Marco Demaio Over a year ago

The IP is not solution cause I would like to call the remote script from my localhost PC, but my IP is dynamically assigned by the ISP (every day it changes it).

dj_segfault Over a year ago

You could resolve the IP address to a hostname and go off the fully qualified domain name. If your ISP is like most, the full domain name will have some geographical region component. That would at least prevent those from other countries from other countries from accessing it. You could also just check the first two numbers (quads) of the IP address which shouldn't change. Or narrowing it down further by looking up exactly what IP address range your ISP owns.

Mr Coder · Accepted Answer · 2011-09-23 13:57:45Z

2

you can use Basic Authentication

answered Sep 23, 2011 at 13:57

Mr Coder

8,1965 gold badges49 silver badges74 bronze badges

1 Comment

Mr Coder Over a year ago

yes kind of since it would be base64 encode of username and password both . As you mention you gona use it with browser you gona get a nice pop up with easy way to enter username and password also checking the browser history will not reveal the "pin" unlike simple GET if you want more secure then en.wikipedia.org/wiki/Digest_access_authentication

Mike Hedman · Accepted Answer · 2011-09-23 13:59:35Z

1

The one problem with your example is that it would be collected by a browser's history collector. So if you typed in this GET at home , and the next day your kid starts typing "rem...", the browser will display the URL and your lone credential. If updating your database is not a destructive thing (it wouldn't be the worst if it happened an extra time or two), and you are relatively careful and disciplined (clear history each time), then this isn't too bad.

Since you're using PHP, you should look at PHP's preferred way.

answered Sep 23, 2011 at 13:59

Mike Hedman

1,4711 gold badge12 silver badges31 bronze badges

Collectives™ on Stack Overflow

Protect call to remote php script

4 Answers 4

1 Comment

2 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

2 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related