This comparison shows two common ways to connect a browser UI with backend microservices.
Both are valid, but they solve different problems.
Variant A: PHP Secure Proxy (Gateway Pattern)
Code: Select all | Expand
┌───────────┐
│ Browser │
│ (Session) │
└─────┬─────┘
│ JSON (report, params)
▼
┌───────────────┐
│ PHP Proxy │
│───────────────│
│ - Session │
│ - Roles │
│ - Validation │
│ - Audit log │
└─────┬─────────┘
│ JSON + service token
▼
┌────────────────────┐
│ Harbour Microservice│
│────────────────────│
│ - Business logic │
│ - DBF access │
│ - No user login │
└────────────────────┘Core idea:
The browser trusts PHP.
The microservice trusts only PHP.
PHP acts as the authority and security boundary.
Variant B: JWT Direct Access
Code: Select all | Expand
┌───────────┐
│ Browser │
│ (JWT) │
└─────┬─────┘
│ JSON + JWT
▼
┌────────────────────┐
│ Harbour Microservice│
│────────────────────│
│ - JWT validation │
│ - Role checks │
│ - Business logic │
│ - DBF access │
└────────────────────┘Core idea:
The browser carries the trust.
Each service validates the token itself.
Visual comparison (simplified)
Code: Select all | Expand
PHP Proxy:
[Browser] → [Central Control] → [Services]
JWT:
[Browser + Trust] → [Services]One-sentence explanation
With a PHP Secure Proxy, authority is centralized in the gateway;
with JWT, authority is decentralized and carried by the token.
When each model fits best
PHP Secure Proxy
- internal or controlled systems
- ERP / hotel software / industry solutions
- legacy backends (DBF, C, Harbour)
- strong audit and traceability requirements
- clear security boundary
JWT
- public APIs
- mobile apps
- many independent services
- fully stateless architectures
- maximum horizontal scalability
Important note: not an “either/or”
These approaches do not exclude each other.
A common hybrid model:
- PHP Secure Proxy at the edge
- JWT or shared secrets inside the service layer
Conclusion
JWT primarily solves a distribution and scaling problem.
A PHP Secure Proxy primarily solves a control, security, and auditability problem.
The better choice depends on system context, not on trends.
For administrative software, a PHP Secure Proxy often feels simpler and more elegant. It centralizes control, embraces state where it already exists, and allows backend services to focus purely on business logic instead of authentication mechanics. That’s why I chose this approach for WINHOTEL Gold Edition.