I know very little about web site software, which makes me a potential liability.

I want to create a simple way to transfer a small amount of information between a dedicated PC and a mobile phone.  I can write the software for both. I don't want to use port forwarding for the PC. 

My thought is to transfer data like this-

The PC can send a GET or a PUT request to the web address (https://www.blahbah) using a 30 character API key type of code. The server can send a reply with data as needed.

The phone does the same maybe with another key.

The speed of updating the data is not critical, if there is a 10 second delay that's fine. There will be no visual aspect to the website and any requests without the correct key will be rejected.

How safe, or not, is this approach? If it is a bad idea I would welcome any suggestions on what I should learn, or where I should look.

Edited November 8, 20196 yr by Martincg
correct typo

If you keep to the basic standards of security in your application you should be fine, as well as the API key it might be a good idea to add basic auth headers as an extra layer of protection (OAuth would be best).

Just some thoughts:

• Make sure the connections are encrypted/secure via SSL
• Add a basic auth username and password to your request headers as well as a api key
• If possible lock down the "www.blahbah" URL to certain devices for your mobile device and from your PC base it on IP address
• Securing the website so that nothing is recorded that doesn't need to be push to it (logs etc)
• Log any failed requests to access the data so you can see if anyone is trying to get to it that shouldn't be

Hope this helps

Yes, that helps me. Thank you.