I'm trying to figure out how to add an extra security layer to my WebApp cURL calls going to my API Engine.
I have a WebApp that sends data to an API engine I made.
My API will have access to the filesystem and therefore has to be quite secure so that there is no way someone can execute a script on the server.
The idea I had to further secure it si to have a
salt on the WebApp and the same one on the API engine, the WebApp will send the cURL with an hashed timestamp and the real timestamp, plus any other request, example:
<?php $hash = "1h2k3jklh"; $tstamp = time(); $hashed_tmstamp = md5($tstamp . $hash); $data_to_send = [ 'time' => $tstamp, 'auth' => $hashed_tmstamp, 'foo' => "bar" ];
On the API side I will check if
auth is equal to the sent timestamp hashed with the API hash (which is the same as the WebApp one).
This way if the
auth is copied and send with a new request will always fail as timestamp updates. I made a little graphical example to better understand.
There is a point, if "the man in the middle" can copy the
auth can also copy
time and can send requests always with the same time and auth.
So I'm wondering how to solve this part as on the API side I don't have a DB to check against "already used hash".
I'm in doubt I'm probably trying to reinvent the wheel and for sure this kind of stuff has already been checked/handled.
The only point is that I do want the "standard way" but I'm trying to add extra security so that a possible hacker does not know what's on the other side.
Any advice? Also, any better idea?