Securing a Codeigniter Restful API accessed via Angular

2
votes

I am creating a Restful server using Codeigniter, that will be accessed via a PhoneGap mobile app. I am not sure how to properly secure the API.

I am using this REST library: https://github.com/chriskacerguis/codeigniter-restserver

This post was helpful, but I have questions: Security PHP RESTful API

I setup codeigniter to store sessions in a table. I have secured using SSL.

  1. Is a Session ID the same thing as a Token?
  2. Do I need to set anything manually in a Auth Header? If so whcih side? On the REST server or in Angular?

I should point out that there are two facets to the app. One part behind a login, and one not.

1
phpangularjscodeigniterrest

1 Answers

1
votes

Assign a token(random-string) to each user account. User should request all web services with a token.

Validate token on behalf of each user and then expose data.