Right off the bat, I'd like to know if there is a widely used library or standard that I could adopt to replace my "custom" scheme. I am certain that I, as one person, cannot produce something better than a community produced library.
That said, I am a security novice, and while reviewing other implementations did not find one that seemed to suit my exact needs. It was probably right under my nose and I didn't understand it.
I am developing a restful api and a javascript client. I intend to honestly implement rest and go stateless, meaning no server side sessions. All the information to answer any request must be passed by client to the server as part of the request.
The security solution needs to provide protection against a third party remote attacker that is moderately to seriously resolute.
I do not intend to protect against an attacker that is in physical custody of either the client or server systems.
So, with all that in mind, here is my custom :( solution.
- Site-wide HTTPS
- At registration to the service, the user's password is passed 'clear' to the server where it is stored in a salted sha-3 hash.
- Upon login, the javascript client does not pass the user id and password to the server. Instead, it generates a random string and stores that in the window.name space. It then uses this string as a passphrase to perform 256bit AES encryption on the name and password, storing this cipher text in a cookie. This cookie has a life of 1 hour.
- Henceforth, all API calls require that the client access the window.name string, decrypt the cookie, and pass the username/password 'clear' to the server. A unix-epoch timestamp is also passed.
- The server, upon receiving any request, retrieves the user's salt, performs a sha-3 hash on the password, and compares it to the stored value in the db. It also ensures that the timestamp is within 60 seconds of the server time.
- If those checks pass, the client is considered authenticated for that single request.
I'm definitely not a security expert, but I figure this forum is. Whatever you suggest I will take to heart.