I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with the following data-part: host, request-method, request-uri, timestamp(to avoid replays) and in case of POST/PUT also the body of the request. Any objection against this?
I'll send the hmac along with the username or maybe a hashed representation (public key) of the user to be able to have different secret keys for each user on the server.
So why not use the hashed password of the user as the secret key? The server has the hash of the password saved to the database next to the user in the usertable in anyway and the client can calculate the hash based on the input of the user and store it in a client session for later usage.
What are the concerns against using the hashed userpassword as a secret key?