如何在PHP应用程序的页面加载期间处理身份验证令牌？

Question

I am confused a bit about a matter. I have made a restful api in php where the entry point is index.php.

Now the point is when a user 'll login a random generated token 'll be sent to the user and from then for any request(to receive html page or json data) user has to sent the token with the request, else user 'll get a 401,unauthorised response.

Now when user 'll make an ajax call the the token has to be sent via http header; and there is no problem. But my confusion is when a user ask for a html page(e.g. report.html) how 'll the user sent the token to authenticate himself/herself before accessing the page?

Currently my solution is as following;

 http://host/app-name/page/token

Is it the right way?

For your information login page can be accessed without token.

Answer 1

You need to use the Header of your request.

Basically, the Header is something that will define your request to the server, the location of the request, the device, the browser,...

By sending it that way your server can handle the authentication without having to read your request, the best way of implementing would be to create a function that will be called before any other to check if the token is valid.

I would recommend using Postman for testing your API, it's simple but effective.

There are other way of identification that are deemed safer if you're interested (look here)

I hope that this will help you, have a nice day ;)