Building Secure APIs with PHP

# CHAPTER 18

Building Secure APIs with PHP #

1. Introduction #

2. Learning Objectives #

• Architect a single-entry-point (Front Controller) PHP API.

• Understand and implement the concept of Security Middleware.

• Use strict typing and declare(stricttypes=1) in PHP 8+.

• Insecure Architecture (The Old PHP Way): The building has 50 different doors (e.g., login.php, getusers.php, deletepost.php). Every single door needs its own security guard. If you forget to put a guard at deletepost.php, a thief walks right in.

• Secure Architecture (The Front Controller Pattern): The building has ONE main entrance (index.php). All 50 side doors are bricked over. Every single person, package, and request must go through the main entrance. Here, a team of highly trained guards (Middleware) checks IDs, scans for weapons, and enforces rate limits *before* escorting the person to the specific room they requested.

4. The Front Controller Pattern #

.htaccess example:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [QSA,L]

This ensures that every API request (GET /users, POST /login) lands in index.php. This is the perfect place to enforce global security rules (like CORS and HTTPS checks) before any logic runs!

5. Implementing Security Middleware #

Conceptual PHP Middleware Architecture:

<?php
// index.php - The Front Controller

// 1. GLOBAL SECURITY (Runs on every single request)
enforce_https();
handle_cors();
check_rate_limits($_SERVER[&#039;REMOTE_ADDR']);

// 2. ROUTING
$path = parse_url($_SERVER[&#039;REQUEST_URI'], PHP_URL_PATH);
$method = $_SERVER[&#039;REQUEST_METHOD'];

// 3. AUTHENTICATION MIDDLEWARE
if (strpos($path, &#039;/api/secure/') === 0) {
    // If the route starts with /secure/, demand a JWT token!
    $user_id = verify_jwt_token(get_bearer_token());
    if (!$user_id) {
        http_response_code(401);
        die(json_encode(["error" => "Unauthorized"]));
    }
}

// 4. CONTROLLER LOGIC (Safe to execute now!)
if ($method === &#039;GET' && $path === '/api/secure/profile') {
    get_user_profile($user_id); 
}
?>

By structuring your PHP app this way, it is *impossible* to accidentally forget to secure a new protected route.

6. Strict Typing in PHP 8+ #

Secure PHP File Header:

<?php
declare(strict_types=1);

// Now, if a function expects an integer ID, and an attacker sends a string, PHP instantly throws a Fatal Error and halts execution, rather than trying to guess the type!
function delete_user(int $id): bool {
    // ...
}
?>

7. Consolidating PDO (Database Security) #

<?php
class Database {
    private static $pdo = null;

    public static function getConnection(): PDO {
        if (self::$pdo === null) {
            $dsn = "mysql:host=localhost;dbname=api_db;charset=utf8mb4";
            $options = [
                // ALWAYS throw exceptions on SQL errors (never fail silently)
                PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
                // Always return associative arrays
                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
                // TURN OFF Emulated Prepares! Forces real prepared statements.
                PDO::ATTR_EMULATE_PREPARES   => false,
            ];
            self::$pdo = new PDO($dsn, &#039;secure_user', 'strong_password', $options);
        }
        return self::$pdo;
    }
}
?>

8. Handling JSON Inputs Cleanly #

<?php
function get_json_input(): array {
    $raw = file_get_contents("php://input");
    $data = json_decode($raw, true);
    
    if (json_last_error() !== JSON_ERROR_NONE) {
        http_response_code(400);
        die(json_encode(["error" => "Malformed JSON payload."]));
    }
    
    return $data; // Return as a clean PHP associative array
}
?>

9. Best Practices #

• Use Composer: Do not reinvent the wheel. Use Composer to install vetted security libraries for JWT handling (firebase/php-jwt) and password hashing, rather than writing custom cryptography.

• Environment Variables: Use a library like vlucas/phpdotenv to load database credentials and API keys from a .env file outside the web root.

• Keep PHP Updated: Security features are constantly added to PHP. Running an API on PHP 5.6 or 7.2 is a massive liability. Always run supported versions (PHP 8.2+).

10. Common Mistakes #

• Leaking phpinfo(): Developers sometimes leave a test.php file containing phpinfo(); on the server. This exposes every single configuration detail, module version, and environment variable to the public internet.

• Poor File Permissions: Setting directory permissions to 777 (Full Read/Write/Execute for everyone) so that file uploads "just work". This allows anyone to modify or execute scripts in those directories.

11. Mini Exercises #

1. 1. What does the declare(stricttypes=1); directive do in PHP?

14. Interview Questions #

• Q: Walk me through how you would architect a secure, modern PHP API. Explain the flow of a request from the .htaccess file to the database.

• Q: Explain the concept of Middleware in PHP. How does it help prevent developers from accidentally leaving an endpoint unsecured?

• Q: What specific PDO configuration options do you set to ensure maximum security and proper error handling?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #