I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with the following data-part: host, request-method, request-uri, timestamp(to avoid replays) and in case of POST/PUT also the body of the request. Any objection against this?
I'll send the hmac along with the username or maybe a hashed representation (public key) of the user to be able to have different secret keys for each user on the server.
Now I'm planning on the secret-key exchange between client (JavaScript) and server (PHP) and got the idea of just using something the server and the client already both know without exchanging it and it should still be different for every user.
So why not use the hashed password of the user as the secret key? The server has the hash of the password saved to the database next to the user in the usertable in anyway and the client can calculate the hash based on the input of the user and store it in a client session for later usage.
What are the concerns against using the hashed userpassword as a secret key?