I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this:
- Client AJAX's some getAuthToken.php page
- Client connects to the websocket server anonymously
- Client sends their authentication token
- Server checks token, authenticates user
getAuthToken.php should generate an authentication token for the current session's username using some symmetric key (shared by the websocket server) and return it.
What would be the best algorithm to use here? I have little experience with cryptography and not sure where to proceed.
One approach that comes to mind would be to SHA-2 hash the username along with some secret key. We'd then pass the username and this hash to the websocket server which would do the same and compare hashes. Include a timestamp with the hash to ensure a unique token each time.
Is the above approach secure? Is there a better approach? I'm not concerned with anything on the wire, we'll be using SSL for all communication - my only concern is the ability to impersonate other users by generating a bogus token through inspection of your own token. The algorithm must be supported in both PHP and node.
Surely there is some standard way of doing this?