Use header() to cooperate with token to implement API permission control

M66 2025-05-17

Security is crucial when developing APIs. To ensure that only authorized users can access specific resources, we usually use the Token mechanism for authentication and permission control. In PHP, the header() function is usually used to send HTTP header information and can be used to handle Token verification. This article will introduce how to use PHP's header() function to cooperate with Token for API permission control.

1. What is Token?

Token is a security credential used for authentication and authorization. Common token types include JWT (JSON Web Token) and OAuth Token. Tokens are usually generated by the server after the user is logged in and stored by the client (for example in the browser's Local Storage or HTTP request header) for authentication in subsequent API requests.

2. Basic process of API permission control

The basic process of using tokens for API permission control is as follows:

The user sends a request to the API and comes with a token.
After the server receives the request, it uses the header() function to read the token in the request header.
The server verifies the legitimacy of the token. If the verification passes, access to the relevant resources is allowed; if the verification fails, a permission denied response is returned.

3. Use header() function to get the token in the request header

In PHP, the HTTP request header can be obtained through the $_SERVER or getallheaders() function. Suppose we want to get a token named Authorization from the request header, here is a simple example:

 <?php
// GetAuthorizationThe one in the headToken
function getAuthToken() {
    if (isset($_SERVER['HTTP_AUTHORIZATION'])) {
        return $_SERVER['HTTP_AUTHORIZATION'];
    }
    return null;
}
?>

The getAuthToken() function checks whether the Authorization header exists and returns the Token. If it does not exist, return null .

4. Verify the validity of the token

When verifying a token, verification is usually required based on the content or signature of the token. Here we assume that to use JWT (JSON Web Token) for token verification. Here is a simplified verification process:

 <?php
// Analyze and VerifyJWT Token
function validateToken($token) {
    $secret_key = "your-secret-key";  // Preset key，For verificationToken

    // A simple one is used hereJWTAnalyze and Verify过程，Actually, ready-made libraries such as Firebase JWT
    // Here is a simplified example
    try {
        // AssumptionsTokenThe format is "header.payload.signature"
        $parts = explode('.', $token);
        if (count($parts) !== 3) {
            throw new Exception("TokenError in format");
        }

        // Simulation VerificationToken（In actual application, it can be decryptedTokenAnd verify the signature）
        $payload = base64_decode($parts[1]);
        $payload_data = json_decode($payload, true);
        if (!$payload_data || !isset($payload_data['exp']) || $payload_data['exp'] < time()) {
            throw new Exception("TokenExpired");
        }

        // Tokenefficient
        return true;
    } catch (Exception $e) {
        // Return when an error occursfalse
        return false;
    }
}
?>

In the above code, we determine whether the token is valid by tearing down the JWT Token and verifying the payload part. In actual production environment, it is recommended to use mature JWT libraries to handle Token verification.

5. Use header() function to send a response

If the Token verification fails, we can use the header() function to return the corresponding HTTP status code, such as 401 (unauthorized) or 403 (access prohibited). For example:

 <?php
// return401Unauthorized response
function sendUnauthorizedResponse() {
    header("HTTP/1.1 401 Unauthorized");
    header("Content-Type: application/json");
    echo json_encode(["error" => "Unauthorized access，请提供efficient的Token"]);
    exit();
}
?>

When the Token verification fails, we call the sendUnauthorizedResponse() function to send a 401 unauthorized response and provide error information.

6. Complete example: API permission control

Combining the previous functions, the following is a complete example showing how to implement API permission control in PHP:

 <?php
// GetToken
$token = getAuthToken();

// If not providedToken，直接return401Unauthorized response
if (!$token) {
    sendUnauthorizedResponse();
}

// verifyToken的efficient性
if (!validateToken($token)) {
    sendUnauthorizedResponse();
}

// ifTokenefficient，Continue to processAPIask
echo json_encode(["message" => "APIask成功，权限verify通过"]);
?>

In this complete example, first get the token in the request, and if the token is empty or invalid, a 401 unauthorized response is returned. If the token is valid, the business logic of the API continues to be executed.

7. Summary

Through PHP's header() function combined with Token, we can easily implement API permission control. The basic workflow includes:

Extract the token from the request header.
Verify the validity of the token.
Decide whether to allow access to the API based on the verification results.

This approach effectively protects the API, ensuring that only authorized users can access sensitive data or resources.

header