Securing REST API in PHP

Question

All my database related files are in config folder (fetch, post, update, delete). and I'm using ajax on the client side to use that data. my question is how can I secure my API files. I've studded about JWT and I think it is only for user login and signup. I want that when someone opens my api url like: 'http://localhost/config/getPosts.php' they should be authenticated before they can see the posts. I've also used basic auth but it is not secure according to my research.

Answer 1

What you want to do is to create a way to check if the user is currently logged in with JWT (Usually done with a middleware) and if not return a 401 error. Then assign the middleware to those routes so you protect those routes with the JWT check.