保护页面免受服务器外部的外部访问

Question

In a backend panel, in order to populate a datatable, I echo the records in a php page in format JSON, then I parse, format and populate the datatable with JS.

The issue is, how do I prevent peoples from accessing that php page and leaking all the informations?

This is what my code look like:

    var options = {
        data: {
            type: 'remote',
            source: {
                read: {
                    url: 'http://127.0.0.1/inc/phpscripts/printinfo.php',
                },
            },
            pageSize: 10,
            serverPaging: false,
            serverFiltering: false,
            serverSorting: false,
        },
        layout: {
            scroll: false,
            footer: false
        },
        sortable: true,
        pagination: true,
        columns: [{
            field: 'id',
            title: '#',
            sortable: false,
            width: 20,
            selector: {
                class: ''
            },
            textAlign: 'center',
        }, {
            field: 'name',
            title: 'name',
        }, {
            field: 'surname',
            title: 'surname',
        }, {
            field: 'address',
            title: 'address',
        }, {
            field: 'phone',
            title: 'phone',
        },
        }],
    };

This is the code of the printinfo.php

    function datatable($userid){
        global $conn;
        $total = totalrows($userid);
        $pagination = ceil($total/10);
        echo '{
        "meta": {
            "page": 1,
            "pages": '.$pagination.',
            "perpage": 10,
            "total": '.$total.',
            "sort": "desc",
            "field": "name"
        },
        "data":';
        $rows = array();
        $query = $conn->prepare('SELECT * FROM table WHERE id = ? ORDER BY name DESC');
        $query->bind_param('i', $userid);
        if (!$query->execute());
        $res = $query->get_result();
        $counter = 0;
        //$rows = array();
        while ($data = $res->fetch_assoc()) {
            $rows[] = $data;
        }
        print json_encode($rows);
        echo '}';
    }
    datatable(SESSION['id']);

While this is the display content of printinfo.php

{ "meta": { "page": 1, "pages": 1, "perpage": 10, "total": 4, "sort": "desc", "field": "level" }, "data":
[{"id":1,"name":"frank","surname":"blank","address":"st andrew","phone":"+1555484845"},
{"id":1,"name":"andrew","surname":"blank","address":"st paroli","phone":"+1555895685"}]}

It works fine, but I don't think this is secure at all.

So, how would you approach it in order to secure the datas?

Answer 1

You should build some authentication scheme, in order to validate the identity of user that fetches your data.

A simple example (not secure at all, but shows the goal) - send some identification code as post request to that php script and validate it there.

Better security can be achieved by creating a database with hashed or encrypted passwords and validating the user at sign in stage. After that validation, you can store some credentials on the server and check in your php script the identity.

Again, this is not so simple as described and should be done carefully.