I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another API #2 (same API provider) with that confirmed exchange rate to execute money exchange.
To avoid storing state on server and to protect the exchange rate from being modified by the user, what I can think of is that API #1 needs to return a plain exchange rate together with its corresponding encrypted one using symmetric key. Then pass the encrypted one to API #2 for transaction execution.
Am I correct? How to securely implement the encryption? Per-user symmetric key with login name & login timestamp? Or generate a session key randomly for every login session?