I'm trying to learn some things about REST apis and one of the topics that I'm having some trouble is security.
I'm using angularjs for web interface ans slim framework for the php api. I've read some articles (I liked this one) and started to implement HMAC following this tutorial (not exactly the same steps). I would like to know if there is some major security breach in my approach or if I'm not doing this the right way.
As I'm using AngularJS, I know that everything I store in the client-side is not safe. I'm assuming that the user has a "clean-as-new" machine and knows what he is doing (I will probably be the major api user). My greater concern is the man-in-the-middle and replication.
(On the client side)
- The user inputs his username and password.
- His password is encrypted (for example, sha256) and stored as a global; (His username is just stored somewhere)
- In every request that the webinterface sends to the api, it is sent a hmac hash in the header in wich the message is formed using the username, a timestamp, the path to the resource, a random string (that both server and client are aware; hardcoded) and the key is the password hash.
(On the server side)
When the server receives the request:
- Checks the timestamp;
- Checks if the username exists in the DB;
- Attempts to replicate the same hmac hash using for the message the variables (also received in the request) username, timestamp, path-to-resource and the random string (this one is not received in the request; it's just hardcoded). For the key he uses the value stored in the DB that is the encrypted password of the given user.
If all validations go well, the user should be a guy to be trusted and not just a man-in-the-middle.