I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as secure as PHP, I decided to have the app interact with the database through the website:
On the website, there's a php file used to establish a link between the app and the database. This is the algorithm i set up to have it as secure as possible:
- User inputs a password in the app, it sends it to the php file as a parameter (/get.php?pwd=1234)
- The website sends a token (call it T0) to the app
- The next time the app wants send a query to the website, it sends the md5 of T0 (call it T1), the website on its side calculates the md5 of T0 and compares it T1
- The next query has to be sent using the md5 of T1 (T2) and the website will compare it with md5 of T1
What's good about this method is that in case of a man-in-the-middle (assuming he doesn't know we use the md5 of the token), reading either the password or T0, it won't serve any purpose.
As an additional security measure, every used token is saved in a separate database containing exact location of the user, ip and the operation done with it.
Since I'm no security expert, I wanted to know how hard it is to infiltrate this system. Thank you