I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows:
T = HMAC(HTTP body || Request Timestamp, S)
So when a part receives http request it recalculates T from the http body, and the timestamp from the Date http header field, and compares it, with the HMAC digest it received. If the digests are equal AND the time offset of the timestamp and the time the request was received is lower than a specified threshold grant the request. Else deny it.
Is this secure? Assuming that the attacker cannot forge the Date header since it is protected from the HMAC, plus the time limit offset(for replay protection), i think it is ok.
Assuming, that the above protocol has no flaws, how long should i set, the valid threshold offset? Say for example 5 seconds is ok?