PHP: Secure a Rest Service with a Token mixed with Timestamp - php

Question

I have a rest service that my website calls it and I want to secure it from calling outside of my website as much as possible.
I want to create a token mixed with timestamp, so the user can only call the service in 10 minutes (for example) with the token that generated in the server.
Let me explain it with some pseudo codes:
1) Server: The token is generated in the server using a private key and timestamp:
// The token is valid only for 10 minutes after 'time'
$token = encrypt($pKey, timestamp); // Server Time
2) Client: We put the token in the javascript variable and use it in our request with the timestamp of the client:
var token = '<?= $token ?>';
var params = {
token : token,
time : timestamp, // Client Time
data : mydata
}
3) Server: If the time parameter mixed with token is not equal to 10 minutes token, the request is invalid:
// I'm Stuck Here
$something = decrypt($pKey, $_POST['token'], $_POST['time']);
if ($something != $tenMinutes) { // Invalid Request }
The Question:
1) Is this senario O.K? If Yes, What is the exact solution? If No, So What is the solution?
2) There is another senario to secure the requests that I've seen in the AWS: http://docs.aws.amazon.com/AmazonS3/latest/dev/S3_Authentication2.html
How can I implement this in PHP?

Answer 1

After you've got token from the client you need to check two things: validity of the token and its timestamp.
There are two scenarios:
Make timestamp part of the token:
function getToken($timestamp) {
return $timestamp . encrypt(getPKey(), $timestamp);
}
$token = genToken(time());
And then validate it:
$token = $_POST['token'];
function validate($token) {
$timestamp = substr($token, 0, 10);
return
(genToken($timestamp) == $token)
&& ($timestamp >= time() - 600);
}
Save generated token in database along with timestamp and after getting token from the client check corresponding timestamp.