With each response sent by the server, it sends an session token.
The session token is an encrypted string containing the following:
- The UserID
- A SessionID
- A salt (randomly generated each time)
- A current time-stamp
- An expire time-stamp, exactly half an hour after the current time-stamp
When the client sends a request, it must also send this session token. The token is decrypted and the time-stamps are checked to see if they are half an hour apart, and that the present time is between the two time-stamps. If so, the request is processed, using the user ID to identify who made the request. If not, the request is not processed, and a response telling the client to log the user out is sent.
Will this system leave us horribly vulnerable to people falsely identifying as a user? Do you see any other problems with this?