Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

kfirba's avatar
Level 50

Guarding an endpoint with OAuth and HTTP tokens

Hello!

I'm planning to be build some endpoint on my website that will receive a POST request from a remote git repository and trigger git pull and some commands after that.

I saw someone mentioning that it's good to guard it with OAuth and HTTP tokens. I would like if someone can elaborate and maybe even give me some reading materials.

0 likes
2 replies
4jZW7jVSdS4U6PC's avatar
Level 29

As I said @kfirba, there're many methods to secure an REST service endpoints, I'll summon this article which explain how Amazon secures the S3 Services.

Amazon S3 is a good model to work with. Amazon, also, use some HTTP basic auth that prevents accidental and malicious requests.

The good part about HTTP Basic is that it's inside the native HTTP 1.1 protocol and almost all HTTP libraries, even the one used by Laravel, supports it. Securing endpoints it's always trivial but you can start from the basic (HTTP basic indeed) and then adding "layers" like SSL, which is great with HTTP Basic because you don't want do sent plain text password via GET/POST request don't you?

There's also the Digest auth, but if you already have SSL you should start with HTTPB because Digest requires an extra layers of logic for exchanging the value between client and the server.

Once you have the identity of the client (via OAuth or HTTPB with password) the rest is up to you. You have to store and make persistent connections between the identity and your server. Again HTTPB shines here because your server ends up with a plaintext copy of the client's password, written by the client itself and secured via SSL, that you can simply pass on to another component within your infrastructure like the Authentication process or a simple if($password = '') if you are lazy as fuck :D

Useful resources

Stack-overflow OAuth with Facebook Much like you'll do with github.

MSDN Securing Web Services Microsoft vision of a good security layer, clear article.

Edit typos

Please or to participate in this conversation.