API Authentication ও Security

API Key

// Header এ (সুপারিশকৃত)
GET /api/weather
X-API-Key: abc123xyz

// Query param
GET /api/weather?api_key=abc123xyz

Basic Auth

Authorization: Basic base64(user:pass)

// PHP
$user = $_SERVER["PHP_AUTH_USER"] ?? "";
$pass = $_SERVER["PHP_AUTH_PW"] ?? "";
if ($user !== "admin" || $pass !== "secret") {
    http_response_code(401);
    exit;
}

Bearer Token ⭐

// Login
POST /api/login → {"token":"eyJhbGc..."}

// পরবর্তী request
GET /api/profile
Authorization: Bearer eyJhbGc...

JWT (JSON Web Token)

header.payload.signature

{
    "alg": "HS256",        ← Header
    "typ": "JWT"
}
.
{
    "user_id": 42,          ← Payload
    "email": "k@mail.com",
    "role": "admin",
    "exp": 1735689600
}
.
signature (verification)

PHP-তে JWT (library দিয়ে)

composer require firebase/php-jwt

use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$secret = "your-secret";

// Create
$token = JWT::encode([
    "user_id" => 42,
    "email" => "k@mail.com",
    "exp" => time() + 3600
], $secret, "HS256");

// Verify
try {
    $decoded = JWT::decode($token, new Key($secret, "HS256"));
    echo $decoded->email;
} catch (Exception $e) {
    http_response_code(401);
}

Password Hashing

// ✅ bcrypt
$hash = password_hash($password, PASSWORD_BCRYPT);

// Verify
if (password_verify($input, $storedHash)) {
    // সঠিক
}

// ❌ কখনোই MD5/SHA1 না
// ❌ plain text কখনোই না

CORS

header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization");

if ($_SERVER["REQUEST_METHOD"] === "OPTIONS") {
    http_response_code(200);
    exit;
}

// Production-এ নির্দিষ্ট domain
header("Access-Control-Allow-Origin: https://myapp.com");

Rate Limiting

$ip = $_SERVER["REMOTE_ADDR"];
$key = "rate:$ip";
$count = $redis->incr($key);
if ($count === 1) $redis->expire($key, 60);

if ($count > 100) {
    http_response_code(429);
    header("Retry-After: 60");
    exit(json_encode(["error" => "Too many requests"]));
}

Security Checklist ✅

• সবসময় HTTPS
• Prepared Statements
• Input validation
• Password hashing (bcrypt)
• Token expiry
• Rate limiting
• CORS সীমিত
• Error message-এ বিস্তারিত না
• File upload যাচাই
• Secret env variable-এ