First of all; the API accepts only HTTPS requests, in case an HTTP request reaches the server it completely ignores it and also (depending on tenant configuration) invalidates the password provided on that insecure request.
My server is stateless and I am using only HTTP(S) basic authentication. I provide two ways of authenticating a request:
1- Sending credentials on header
Authentication: base64('Basic ' + user:password)
2- Sending an authenticated request using method 1 to
GET /users/current which returns a token that is an encrypted string* containing:
username + '|' + timeOfTokenExpiration. Client then sends only header
Authentication: base64('Token ' + username:returnedToken) thereafter.
*Encryption is done with OpenSSL's aes-256-ctr algorithm, and key is user's password hash
Storing user credentials on browser's local storage would solve this issue but would keep the user indefinitely logged, creating another possible security threat. Also I am not sure how secure it is to store credentials in clear text on browser's memory.
At server side I check authenticity of a method 2 request by retrieving user's password hash and trying to decrypt it. After decryption I check if
decryptedString.split('|') === username.
Is this a safe/good approach?