【发布时间】：2021-09-03 00:40:03
【问题描述】：
我学习编程、网络数据传输和 API。我创建了一个在两个网站之间传输数据的简单模型。关于以下过程，我有三个基本问题。在审查中，假设两个网站都设置了 TLS。
-
下面的简单过程对于两个网站之间的数据传输来说是一个很好的安全架构吗？
-
这个简单的例子可以称为 API 吗？
-
在此示例中，如何实现额外的安全性（即 API 密钥等）？
网站 1 - 用于捕获和发送数据的简单 Web 表单：
<!DOCTYPE HTML>
<html>
<head>
</head>
<body>
<?php
// define variables and set to empty values
$name = $email = $gender = $comment = $website = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
$name = test_input($_POST["name"]);
$email = test_input($_POST["email"]);
$website = test_input($_POST["website"]);
$comment = test_input($_POST["comment"]);
$gender = test_input($_POST["gender"]);
}
function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
?>
<h2>PHP Form Validation Example</h2>
<form method="post" action="include/redirect.php">
Name: <input type="text" name="name">
<br><br>
E-mail: <input type="text" name="email">
<br><br>
Website: <input type="text" name="website">
<br><br>
Comment: <textarea name="comment" rows="5" cols="40"></textarea>
<br><br>
Gender:
<input type="radio" name="gender" value="female">Female
<input type="radio" name="gender" value="male">Male
<input type="radio" name="gender" value="other">Other
<br><br>
<input type="submit" name="submit" value="Submit">
</form>
</body>
</html>
网站 1 包含在提交表单时运行的文件：
<?php
if (isset($_POST['name']) && $_POST['name']!="") {
$name = $_POST['name'];
$url = "https://localhost/api/api/".$name;
$client = curl_init($url);
curl_setopt($client,CURLOPT_RETURNTRANSFER,true);
$response = curl_exec($client);
$result = json_decode($response);
echo "<table>";
echo "<tr><td>Name:</td><td>$result->name</td></tr>";
echo "<tr><td>Amount:</td><td>$result->amount</td></tr>";
echo "<tr><td>Response Code:</td><td>$result->response_code</td></tr>";
echo "<tr><td>Response Desc:</td><td>$result->response_desc</td></tr>";
echo "</table>";
}
?>
网站 2 - 在包含文件中调用：https://localhost/api/api/".$name;。网站 2 接收数据并为其分配金额并返回数据。
<?php
header("Content-Type:application/json");
if (isset($_GET['name']) && $_GET['name']!="") {
$name = $_GET['name'];
}
else {
response(NULL, NULL, 400,"Can't process options now, visit local dealer");
}
if($name=="Joe"){
$amount = "700";
$response_code = "Good";
$response_desc = "Good";
response($name, $amount, $response_code,$response_desc);
}
else {
response(NULL, NULL, 200,"Can't process options now, visit local dealer");
}
function response($name,$amount,$response_code,$response_desc){
$response['name'] = $name;
$response['amount'] = $amount;
$response['response_code'] = $response_code;
$response['response_desc'] = $response_desc;
$json_response = json_encode($response);
echo $json_response;
}
?>
【问题讨论】：