Android（ios）到PHP API安全性

Question

I am doing a RESTful API design for android using php. Because of this, I am creating PHP API's which will go into my Database and serve specific data based on the method/function called.
but after reading some tutorials,I encounter some quetions and I can’t find a good way to solve my problem.my question is as following:

1.how can I maintain the session between my API and android.In other words,if the user login the system through android,how can I maintain the session?some use PHPSESSID and others use userid(returned by the api),which is better?

2.how can I protect my API from misuse?I find many use apikey

3.how can I protect malicious user tamper the data?this is related to my first question,if I use the userid to maintain the session between my API and android,based this,even if i use apikey, malicious user also can tamper his userid to other’s,so he will get other’s infomation .

I am stucked so much,so please help me?

Answer 1

I recommend you to read About HMAC authentication.

1. You will don't maintain the session... every request to server will send some token data in the request header.

2. You can work on it, thinking in ways to protect your server. The most important think is to follow the best practices and when your software are in production check your logs often.

3. Use the HMAC or some similar method.

You need to change your mind to don't store sessions, and follow the API best practices. I good idea are read the instagram, facebook, g+ and gdrive docs to see how they do.