Question

So I have Symfony project which is also in charge of database abstraction and the data layer. In short – all data requests should go through it.

Now I want to have external components that will want to query / update stuff in the database, using web service API that I expose.

Question: How do I make sure these web services are running inside a secure channel? I don’t want unauthorized users to update my database, and I don’t want eavesdroppers get hold of sensitive data. Is setting up client authentication using PKI a viable option? or is it overkill? What’s the way this is tackled?

Thanks!
-DBG

Answer 1

First of all, you if you have a limited number of service users, and know their ips, you can restict access to ceirtain urls by ips.
Next, have a look at Practical symfony, where they embed an authentication token into the url.