How to secure a web service (API)

Question

API

Good afternoon.

There is a web service on php-apache (self-written, a bit like this one ). Service for working with the MySql database. The service is needed because hosting often has problems with the availability of the database remotely (not localhost). It is necessary to register IP and other inconveniences. The program in C# will work with the service.

Actually the question is: How to protect a web service from other people's Evil

1. No one will know the address of the service, how to protect it from publication and indexing?
2. http://developers.vgorode.ru/wiki/Protected_application_interaction_with_API - here it is written about the md5 signature, but where can I read how and from what it protects and what check should be done on the server?
3. What (what algorithm) can be encrypted, so that it can be implemented in php and .net (well, or download ready-made, free). The service will have one client - this program, so the keys can be sewn directly into the code.

Answer 1

what to encrypt?
send the key, php checks it, if it is incorrect, sends nothing, if it is correct, it sends the data.

Answer 2

@mark_ablov
It seems to me that AES won't protect against an attacker cloning legitimate requests. There is no randomized connection establishment (as in SSL), no timestamps with a check for repetitions, as described in the topicstarter link.

Answer 3

OAUTH?

Answer 4

A self-signed CA certificate and the client authentication certificates issued by it, works at the Apache level, a client without a certificate will receive a 401 error and will not see anything. You can make as many client certificates as you like, they can also be revoked through the revocation list. Also, in the Common Name of the certificate, you can specify any data that identifies the user in the system, i.e. The certificate can be used for both authentication and authorization.