Implement token for Laravel 4 RESTful API authentication

Question

I'm a beginner to Laravel 4 framework and PHP.

Currently, I'm trying to do a simple authentication process between client application and server.

Below is my planned approach:

Client logs in to server via GET request with username and password.
Server validates and returns a token string if successful. The token string will be encoded (hashed?) with the username, password and expiration time.
Client submits a request, including the given token. Server will validate token (decode it -> check username/password and expired time). If successful, it will process the client's request.

What is the best way to generate the token with the above parameters given, and decode it at the server side?

Thank you, and I appreciate your time and help.

If you'r passing usernames and passwords around with each request, you may want to consider using multiple salts/encryptions. You could look at laravel libraries but from a pure PHP perspective you could look at the new password_hash function set built into PHP 5.5 at php.net/manual/en/book.password.php and its foward compatability libary for PHP 5.3.7+ at github.com/ircmaxell/password_compat — Sy Holloway
– Sy Holloway, Commented Sep 19, 2013 at 16:06

Martin Komara · Accepted Answer · 2013-09-18 10:16:09Z

11

I don't think it is good idea to store user name and password encoded in some kind of token. Instead generate random token after successful login and store data related to the token on server side.

You may store record about each login into some table with columns token, user_id, valid_until. After each request, look for token in the database, check if it is still valid and use user_id for authentication.

You may think of token as one-time user and password, e.g. consider first 8 characters of token as temporary user name and the rest as password, if you feel uneasy about allowing access without password :)

Also you may want to run some cron job to remove expired records from database every day or so.

answered Sep 18, 2013 at 10:16

Martin Komara

7676 silver badges9 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

cjol Over a year ago

Wouldn't this violate the principle that REST is supposed to be stateless?

93196.93 Over a year ago

Agree auth @Hephistocles, REST is stateless. It would be better to send username and password or a key in HTTP headers if authentication is required.

rohitnaidu19 · Accepted Answer · 2015-05-26 13:48:50Z

1

You can use JWT JSON web Tokens for authentication to eliminate sessions and cookies completely. Similar approach is used by Facebook. Once you login with email and pwd you get a Web Token so even if its hacked you can't get the pwd from it. You can set a time limit to expire the token.

answered May 26, 2015 at 13:48

rohitnaidu19

6935 silver badges23 bronze badges

Collectives™ on Stack Overflow

Implement token for Laravel 4 RESTful API authentication

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related