Right off the bat, I'd like to know if there is a widely used library or standard that I could adopt to replace my "custom" scheme. I am certain that I, as one person, cannot produce something better than a community produced library.
That said, I am a security novice, and while reviewing other implementations did not find one that seemed to suit my exact needs. It was probably right under my nose and I didn't understand it.
The security solution needs to provide protection against a third party remote attacker that is moderately to seriously resolute.
I do not intend to protect against an attacker that is in physical custody of either the client or server systems.
So, with all that in mind, here is my custom :( solution.
- Site-wide HTTPS
- At registration to the service, the user's password is passed 'clear' to the server where it is stored in a salted sha-3 hash.
- Henceforth, all API calls require that the client access the window.name string, decrypt the cookie, and pass the username/password 'clear' to the server. A unix-epoch timestamp is also passed.
- The server, upon receiving any request, retrieves the user's salt, performs a sha-3 hash on the password, and compares it to the stored value in the db. It also ensures that the timestamp is within 60 seconds of the server time.
- If those checks pass, the client is considered authenticated for that single request.
I'm definitely not a security expert, but I figure this forum is. Whatever you suggest I will take to heart.