FiveTech Support Forums

This comparison shows two common ways to connect a browser UI with backend microservices.
Both are valid, but they solve different problems.

Variant A: PHP Secure Proxy (Gateway Pattern)

┌───────────┐
│  Browser  │
│ (Session) │
└─────┬─────┘
      │  JSON (report, params)
      ▼
┌───────────────┐
│   PHP Proxy   │
│───────────────│
│ - Session     │
│ - Roles       │
│ - Validation  │
│ - Audit log   │
└─────┬─────────┘
      │  JSON + service token
      ▼
┌────────────────────┐
│ Harbour Microservice│
│────────────────────│
│ - Business logic    │
│ - DBF access        │
│ - No user login     │
└────────────────────┘

Core idea:
👉 The browser trusts PHP.
👉 The microservice trusts only PHP.

PHP acts as the authority and security boundary.

Variant B: JWT Direct Access

┌───────────┐
│  Browser  │
│   (JWT)   │
└─────┬─────┘
      │  JSON + JWT
      ▼
┌────────────────────┐
│ Harbour Microservice│
│────────────────────│
│ - JWT validation   │
│ - Role checks      │
│ - Business logic   │
│ - DBF access       │
└────────────────────┘

Core idea:
👉 The browser carries the trust.
👉 Each service validates the token itself.

Visual comparison (simplified)

PHP Proxy:
[Browser] → [Central Control] → [Services]

JWT:
[Browser + Trust] → [Services]

One-sentence explanation

With a PHP Secure Proxy, authority is centralized in the gateway;
with JWT, authority is decentralized and carried by the token.

When each model fits best

PHP Secure Proxy

• internal or controlled systems
• ERP / hotel software / industry solutions
• legacy backends (DBF, C, Harbour)
• strong audit and traceability requirements
• clear security boundary

JWT

• public APIs
• mobile apps
• many independent services
• fully stateless architectures
• maximum horizontal scalability

Important note: not an “either/or”

These approaches do not exclude each other.

A common hybrid model:

• PHP Secure Proxy at the edge
• JWT or shared secrets inside the service layer

Conclusion

JWT primarily solves a distribution and scaling problem.

A PHP Secure Proxy primarily solves a control, security, and auditability problem.

The better choice depends on system context, not on trends.

For administrative software, a PHP Secure Proxy often feels simpler and more elegant. It centralizes control, embraces state where it already exists, and allows backend services to focus purely on business logic instead of authentication mechanics. That’s why I chose this approach for WINHOTEL Gold Edition.