PHP - Protect RESTful API requests

Question

I use a JSON API to get data for a website. I am aware of various methods that I could make it secure, but my situation is different from common methods.

Because of cross domain issues, I had to create an API folder with various PHP files that do cURL requests to the REStful API. I then request these local PHP files through AJAX on my site. On the next release it should be JSONP to avoid this issue.

Many of these JSON requests contain sensitive information so the first thing I did was check for the HTTP Referrer so people don't just grab the URL when inspecting the JavaScript code and try to run it on their browser. This is obviously not safe nor should I rely on it.

Any data I may try to post to the request will be through JavaScript so something like an API key or token would be visible and would defeat the whole purpose.

Is there a way I can prevent these PHP files to be run outside the website or something? Basically make them inaccesible for visitors?

Answer 1

This does not have to do anything with REST. You have a server side REST client, in which you call the REST service with cURL and the browser cannot see anything of this process. Until you don't want to build your own REST service for this AJAX client this is just a regular webapplication (from the perspective of the browser and the AJAX client ofc.). As Lorenz said in the comment, you should use sessions as you would do normally. That's all. If you want to restrict access to certain pages, you can use an access control solution, eg role based access control is very common.