I am currently part of a team trying to build an e-commerce platform with Magento, and we also happen to need a way for the site to interact with a mobile app we are developing in parallel. We ran into problems with REST (highly convoluted token setup for a mobile app) and SOAP (too slow), but I was able to get something to work by creating my own PHP files on the web server that call Mage.php for relevant queries.
I keep my PHP files in a self-made folder that can be accessed through a URL that looks this:
The app sends data to these PHP files through HTTP Post, and the PHP script processes the data received before finally sending response data back to the app. This has so far been really useful since it has turned out to be much faster, and allows us to work with custom functionality we have added to the website since. But I would like to know if this is considered secure.
For what it's worth I always make sure that sensitive data queries are accompanied with a username and password for authentication without which the PHP script will not do anything, and as far as I know the inner workings of a PHP file should remain hidden from the user. Is there any inherent problem with setting up the client-server functionality this way? Is there a better/easier way of allowing the app to properly talk to the server?