Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a
Token model. The client always sends the access token in an
Authorization header. For requests that require authentication, parse the header, check if it is in the database, and pull up the user id (also stored in the
Token model) based on the row. Assuming the user_id exists and the token is marked as still valid, complete the request.
Everything is over HTTPS. Tokens have no expiration. If it is invalid, I delete the token on the client and then the user would be prompted for another. Tokens are just random, long alphanumeric strings
Is this reasonable? Is it secure? Should I use some preexisting paradigm?