I want to use token-based authentication where the user would log in with a username/password combination. The server would make sure the username and password match and then return a token which would be used by the client to make subsequent API calls. These token would expire after a certain amount of time (4 hours is what I'm thinking), after which the user would have to login in again.
The way I want to generate tokens is this : SHA256 hashes of 3 randomly generated strings (characters - [0-9,a-z,A-Z]), concatenated. I would store this token in a database table along with the username and the login time.
When an API request is made with this token, I would be able to get the user from the token.
I want to protect against brute force attacks.
I want to implement all of this in PHP. Is this approach good enough? If not, why? And what would be a better way to do it? Should there be a way to get the user just from the token (without looking up from a database)? If so, why?
I'm a newbie as far as security is concerned, so detailed explanations would be greatly appreciated.