I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm planning to use:
- API Key records are stored within the database
- Each API Key record consists of a public API key and a private API key
- API clients use the private API key to salt the hashing of the given username / password
- Username, password, and public API key are sent via HTTP GET request to the API for validation
- A custom response code is returned based on what happens at the server
Is this a secure way of proceeding? Any advice is greatly appreciated.