How to authorize an android app for a php-database-webservice?

Recently I programmed a little app for my android device. As the datastorage for the app, Iam using a mysql database, which can be accessed via different php scipts. So all the app does, is it sends POST requests to the php scripts to communicate to the database.

But now I consider about the security aspect. These php scripts can be accessed by every webclient. So every webclie开发者_如何学运维nt has the possibility to compromise my database, which is of course not the ideal case. So I was wondering if there is a way to just allow authorized clients to use these php-webservices? Does php provide any kind of authentification that can be used by an android client?

Cheers

---

You simply need to require an authentification when invoquing the service:

• simple and dirty: http basic auth, like Twitter used to do
• a better solution is OAuth, like Twitter now does

There are of course other possibilities (WS-Security, but you don't seem to use SOAP).

---

for security, you should prefer to interact through an API to your mysql...isn't it?

---

A few points:

Use a different port (i.e: not 80 or 8080) for the web access

Add authentication with a username and password. Inside your application, you can get these from a secure config file.

On the server side, you can also do some checking on user agents, IP addresses and maybe even device ids.

This is just a start