Note: Original question asked at https://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it.
The company that I current work for has an internal application, it provides some RESTful (sort of, just a collection of URLs) APIs. To access the APIs outside of the company network would require an HTTPS connection and a token (if accessing within the company network, no restriction is applied).
To call an API, the caller (another internal application or employee) will need to create a token by something like this:
- Sort the URL parameters
- Hash part of the sorted URL with a salt (global constant)
- Use a substring of the hash as the token
- Append that token as a parameter in the URL and send the request
The server will perform the same algorithm on the original URL, if the token comes out the same, the request is considered authenticated.
I am no security expert, but this feels wrong to me, but I can't fully explain why. So I'm asking for help from the security experts, what are problems you see here? Or am I being too paranoid?
Thanks.