To avoid having the user to login every time his session expires, I want to implement a token based authentication system.
My scheme works like this:
- Send the user login (send name + password) via
- Create a token via
$token = bin2hex(openssl_random_pseudo_bytes(16));
useridand date in a database (only accessible by SSL)
- Echo the
useridto the client
- Save the
useridin html localStorage on the client
- When doing an
$.ajax()from client always send
- Serverside, match the provided
$tokenand see if it is still valid (date not expired).
- If it's alright, continue to deliver the requested material
Can you analyze my scheme?
Many people advise against implementing custom authentication processes, as they are often vulnerable to attacks. This makes me suspect that my approach may also have flaws. Can you reveal these flaws to me?