This comparison shows two common ways to connect a browser UI with backend microservices.
Both are valid, but they solve different problems.
---
Variant A: PHP Secure Proxy (Gateway Pattern)
┌───────────┐
│ Browser │
│ (Session) │
└─────┬─────┘
│ JSON (report, params)
▼
┌───────────────┐
│ PHP Proxy │
│───────────────│
│ - Session │
│ - Roles │
│ - Validation │
│ - Audit log │
└─────┬─────────┘
│ JSON + service token
▼
┌────────────────────┐
│ Harbour Microservice│
│────────────────────│
│ - Business logic │
│ - DBF access │
│ - No user login │
└────────────────────┘Core idea:
PHP acts as the authority and security boundary.
---
Variant B: JWT Direct Access
┌───────────┐
│ Browser │
│ (JWT) │
└─────┬─────┘
│ JSON + JWT
▼
┌────────────────────┐
│ Harbour Microservice│
│────────────────────│
│ - JWT validation │
│ - Role checks │
│ - Business logic │
│ - DBF access │
└────────────────────┘Core idea:
---
Visual comparison (simplified)
PHP Proxy:
[Browser] → [Central Control] → [Services]
JWT:
[Browser + Trust] → [Services]---
One-sentence explanation
With a PHP Secure Proxy, authority is centralized in the gateway;
with JWT, authority is decentralized and carried by the token.
---
When each model fits best
PHP Secure Proxy
- internal or controlled systems
- ERP / hotel software / industry solutions
- legacy backends (DBF, C, Harbour)
- strong audit and traceability requirements
- clear security boundary
JWT
- public APIs
- mobile apps
- many independent services
- fully stateless architectures
- maximum horizontal scalability
---
Important note: not an “either/or”
These approaches do not exclude each other.
A common hybrid model:
- PHP Secure Proxy at the edge
- JWT or shared secrets inside the service layer
---
Conclusion
JWT primarily solves a distribution and scaling problem.
A PHP Secure Proxy primarily solves a control, security, and auditability problem.
The better choice depends on system context, not on trends.
For administrative software, a PHP Secure Proxy often feels simpler and more elegant. It centralizes control, embraces state where it already exists, and allows backend services to focus purely on business logic instead of authentication mechanics. That’s why I chose this approach for WINHOTEL Gold Edition.