Question

I’m using the PHP Tonic framework.
I took this example as starting point:GitHub link

I would like to add an auth method based on cookie. Is that the correct solution?
The previous one was based on a token variable in the querystring something like:
/serviceName?token=XXXXXXXXxxXX**&
The token was valid for 10 seconds.

Of course, it’s not a proper solution. I cannot use the browser cache, because the token changes every call.
Ideas?

Answer 1

A possible solution is using the HTTP headers.

$urlToCall = '<get the link>';
$credentials =  Crypt::createToken();
$reqHeaders = apache_request_headers();

// Configuring curl options extra:CURLOPT_HEADER => 1,
$options = array(
    CURLOPT_RETURNTRANSFER => true, 
    CURLOPT_HTTPHEADER => array('Authorization: ' . $credentials)
);

$ch = curl_init($urlToCall);
curl_setopt_array($ch, $options);
$response = curl_exec($ch);

/*
//$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
//$header = substr($response, 0, $header_size);
//$body = substr($response, $header_size);

if (curl_errno($ch)) {
    print curl_error($ch);
} else {
    list($headers, $content) = explode("\r\n\r\n", $response, 2);
    foreach (explode("\r\n", $headers) as $hdr) {
        header($hdr);   
    //echo $hdr . '<br>';
    //print_r($hdr);
    }
    echo $content;
}
*/

if (curl_errno($ch)) {
    print curl_error($ch);
} else {
    header("Accept: " . $reqHeaders['Accept']);
    $finfo = new finfo(FILEINFO_MIME);
    header("Content-Type: " . $finfo->buffer($response));
    print $response;
}
curl_close($ch);