Question

Recently I programmed a little app for my android device. As the datastorage for the app, Iam using a mysql database, which can be accessed via different php scipts. So all the app does, is it sends POST requests to the php scripts to communicate to the database.

But now I consider about the security aspect. These php scripts can be accessed by every webclient. So every webclient has the possibility to compromise my database, which is of course not the ideal case.
So I was wondering if there is a way to just allow authorized clients to use these php-webservices?
Does php provide any kind of authentification that can be used by an android client?
Cheers

Answer 1

You simply need to require an authentification when invoquing the service:

• simple and dirty: http basic auth, like Twitter used to do
• a better solution is OAuth, like Twitter now does

There are of course other possibilities (WS-Security, but you don’t seem to use SOAP).