I'm building web-app. And i have concern about security issues.
In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i made this question.
I have login page with username and password. User will POST them by HTTPS.
Server will compare it with username and password from DB and if everything is ok, will generate
access_token using some specific approach like:
sha1(username + password + expiration_date), btw,
expiration_date it's Unix time of expiration that token. In result
access_token will be written into DB to related User record,
Then all requests from client app will be made by HTTPS and access_token will be included into each header request. Server side should authorize this request, and detect User ID who had sent this request. Server will make search in DB by
access_token and will check
expiration_date). After access_token will be founded need to check next condition:
current_date <= expiration_date, if true then ok, if false then we need to regenerate access_token using new expiration_date and save them to DB and send new
access_token to client?
if Yes then what do you think about that approach form security side ?