I have an Angular JS Front end which consumes Web Services from an API developed using Laravel 5.
BACKGROUND INFORMATION 1
When the user logs in, if it's successful the API returns a token and the token it's like this:
$token = base64_encode("mail=" . $mail); return Response::json(["token" => $token, 'error' => null]);
Then I have a function in an angular service that knows how to work with the token.
BACKGROUND INFORMATION 2
Every time a user needs to get data, the API takes the mail that is sent to the request as one of the headers request. In Laravel, I have a Middleware that takes that token and do the following validations:
- The token is within the headers (in the authorization header)
- The token is valid token
- The email retrieved by the token exists on the database
If any of this validations fails, the API sends a 422 bad request with some error.
My real concern about this is, is it possible to someone to hack my website? Is it possible for someone (knowing someone else's email on the website) to change that authorization header that contains the email?
In theory, the user gets a token if he/she had a successful login, if they didn't they won't get it.